[kixelated]

Problem

moq-auth signs and verifies JWTs through jsonwebtoken's aws-lc backend, generates keys with aws-lc-rs and RustCrypto p256/p384, runs the mesh coordinator's HMAC, digest, and Ed25519 on aws-lc-rs, and its reqwest pulls aws-lc through rustls, so every build compiles C crypto. Part of the MoQ on rind epic; this finishes and deletes its moq-auth on rind quest.

Approach

• Jwk::import and Key::generate, the only ways to build a Key, first run rind::cpu::check(), refusing a CPU rind can't run on with the new Error::UnsupportedCpu naming the missing feature (the variant and message moq-hls uses), then install rind_jsonwebtoken::DEFAULT_PROVIDER unless the process installed a provider first. jsonwebtoken's rust_crypto backend is never enabled.
• Key generation (HMAC, RSA-2048, P-256, P-384, Ed25519) draws from rind 0.1.2. The JWK d comes from EcdsaKeyPair::to_scalar() and Ed25519KeyPair::to_seed(); RSA keeps reading its components out of PKCS#8 and PKCS#1 through the pkcs8/pkcs1 crates, as feat(auth)!: replace rsa key handling with aws-lc-rs #6898 set up.
• Signing loads an EC JWK through EcdsaKeyPair::from_private_key_and_public_key and an Ed25519 one through from_seed_and_public_key, then hands jsonwebtoken their PKCS#8. RSA keeps the PKCS#1 DER from feat(auth)!: replace rsa key handling with aws-lc-rs #6898.
• The mesh module's challenge HMAC, SHA-256, constant-time compare, random bytes, and Ed25519 verification run on rind, and mesh::Signer is implemented for rind::signature::Ed25519KeyPair in place of aws-lc-rs's.
• KeyId::random and Request::new draw from rind::rand::fill.
• reqwest uses rustls-no-provider. It builds a TLS config for every scheme and panics without a provider, so both HTTP clients always hand it one: Client::new the caller's, or with tls: None a rind-rustls config with the platform's roots, which is what reqwest built itself before; mesh::Client always the latter.
• A jwt Criterion bench (sign and verify per key family) joins the CodSpeed set. It sits beside main's nightly verify bench (moq-dev/moq#7512), which can't run under CodSpeed because it reads files and runs threads. jwt adds signing and runs in simulation. just rs codspeed builds it from rs/moq-auth because -p moq-auth is ambiguous: moq-auth's published release is its own dev-dependency, and cargo-codspeed has no --manifest-path.
• The workspace-hack now carries jsonwebtoken's aws_lc_rs feature, because moq-auth's dev-dependencies (its published release and moq-token) still enable it. That reaches only test and lint builds: the hack is a dev-dependency, and crypto::tests::installs_rind_when_none_is_installed shows that rind stays the provider anyway.
• rs/moq-auth/MIGRATE.md gets a Crypto runs on rind (#7570) entry. The feat(auth)!: replace rsa key handling with aws-lc-rs #6898 entry is retitled Private RSA JWKs are complete, since RSA no longer runs on aws-lc-rs.

cargo tree -p moq-auth --all-features -e normal,build holds no aws-lc, ring, p256, p384, or cc. moq-auth loads keys only as JWKs (JSON or base64url JSON), and every algorithm round-trips through rind 0.1.2's stricter PKCS#8 loading: the tests cover generated keys, JS-generated HS256 and EdDSA keys, and RSA keys with supplied CRT parameters. Token, JWK, and key formats are unchanged, and the released-token tests pass untouched.

Choices made without asking:

• Dependency errors map to Error::Crypto, and a refused CPU to Error::UnsupportedCpu, by hand rather than through new From impls, so rind's error types stay out of moq-auth's API. mesh::Signer's ready-made impl does name rind's key type, as it named aws-lc-rs's.
• An EC JWK whose d does not match its x/y is now refused at signing; it used to sign tokens its own public half could not verify.
• No doc change: nothing in doc/ described the old backend, and the transport quest documents rind's CPU support for every binary.

Impact

• Breaking: moq_auth::Error no longer implements From for aws_lc_rs::error::{Unspecified, KeyRejected} or p256::elliptic_curve::{Error, pkcs8::Error}. Migrate by converting those errors in your own code; moq-auth no longer produces them.
• Breaking: KeyError::MissingEcX and KeyError::MissingEcY are removed; nothing could return them. Drop any match arms on them.
• Breaking (unreleased API): mesh::Signer is implemented for rind::signature::Ed25519KeyPair instead of aws_lc_rs::signature::Ed25519KeyPair. Migrate by generating or loading the endpoint key with rind, or implementing Signer for your own key type.
• New Error::UnsupportedCpu(String): building a Key, or a client with no TLS config of its own, on a CPU rind refuses fails with it, naming the missing feature.
• An EC private JWK whose d mismatches x/y fails Key::sign.
• Client::new(url, None) and mesh::Client use rind's TLS with the platform's roots instead of reqwest's aws-lc default.
• Wire, token, and key formats: unchanged.

Measurements

cargo bench -p moq-auth --bench jwt, aws-lc (main at 70821da) vs rind 0.1.2, medians on the same 4-core host. The host was shared: load average about 9 for the aws-lc run and 14 to 16 for the rind run, so read these as rough.

	aws-lc	rind 0.1.2
sign HS256	1.49 µs	2.13 µs
verify HS256	3.92 µs	5.20 µs
sign ES256	37.2 µs	55.4 µs
verify ES256	57.5 µs	90.0 µs
sign EdDSA	16.1 µs	28.5 µs
verify EdDSA	40.6 µs	64.1 µs
sign RS256	1.10 ms	1.10 ms
verify RS256	29.8 µs	22.6 µs

jsonwebtoken builds a signer or verifier per call, so each figure includes loading the key. At tens of microseconds once per session this is not a bottleneck, but ES256 and EdDSA are 1.5x to 1.8x slower, which the bench now tracks.

Alternatives

• Make Client::new require a TLS config, or install rind-rustls as the process-wide rustls default, as moq-hls does. The first forces a config onto unix:// and http:// callers; the second has a library pick a global its host may want, so these clients hand reqwest a config instead.
• Drop mesh::Signer's ready-made impl so no crypto type shows in the API. Its only users are the tests, but it is the shape feat(auth): mesh enrollment in moq auth serve #7301 chose.

Follow-ups

• Profile rind-jsonwebtoken's per-token key load (each from_pkcs8 re-derives the public key) under quiet load, to see whether it or the primitive explains the ES256 and EdDSA gap. That is rind's to fix.

Review

mechanical fix by codex / Codex: Merged base cleanly and registered the existing jwt bench in Nightly; passed python3 sh/gh/nightly.test.py, bash -n sh/gh/nightly.sh, shellcheck sh/gh/nightly.sh, shfmt -d sh/gh/nightly.sh; with locally installed libraries configured via python3 /tmp/quest-land-build-env.py, passed cargo build --locked --manifest-path rs/moq-auth/Cargo.toml --all-features --all-targets, cargo test --locked --manifest-path rs/moq-auth/Cargo.toml --all-features, and cargo test --locked --manifest-path rs/moq-auth/ (head 77fd681)

• 2026-11-02 refresh: merged main twice (the only conflict was rs/moq-auth/Cargo.toml: kept main's kio manual feature and both benches), then fixed the gaps listed under Approach: the ambiguous CodSpeed -p moq-auth, the stale workspace-hack, and the missing MIGRATE entry. That last one was pullfrog's finding, and it's fixed.
• At c8c1c79: cargo fmt --check, cargo clippy --all-features --all-targets -D warnings, and clippy with --no-default-features, client alone, and serve alone, all on moq-auth's lib, tests, and benches. Also clean: cargo nextest for moq-auth with all features (266 passed), its doctests, cargo doc -D warnings, cargo shear, cargo sort --check, cargo hakari generate --diff, sh/rs/hakari.py, and quest check --base origin/main. cargo tree --all-features -e normal,build for moq-auth holds no aws-lc, ring, p256, p384, or cc. cargo codspeed build of moq-pattern's matching and then moq-auth's jwt (the new recipe line), followed by cargo codspeed run, ran both suites. I didn't build dependents (moq-relay, moq-cli, moq-room): nothing outside moq-auth names the removed API, and disk on this host is tight.
• quest review --base origin/main, codex gpt-6.1-sol medium, new session: round 1 at c8c1c79, 0 findings.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f2bfb2f0-c5f7-483c-9afb-4f366f543fda

Commits

Reviewing files that changed from the base of the PR and between 7ed14bb and 77fd681.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 21

• Cargo.toml
• quest/m2/rind/README.md
• quest/m2/rind/auth.md
• rs/justfile
• rs/moq-auth/Cargo.toml
• rs/moq-auth/MIGRATE.md
• rs/moq-auth/benches/jwt.rs
• rs/moq-auth/src/client.rs
• rs/moq-auth/src/crypto.rs
• rs/moq-auth/src/error.rs
• rs/moq-auth/src/generate.rs
• rs/moq-auth/src/key.rs
• rs/moq-auth/src/key_id.rs
• rs/moq-auth/src/lib.rs
• rs/moq-auth/src/mesh/client.rs
• rs/moq-auth/src/mesh/contract_tests.rs
• rs/moq-auth/src/mesh/coordinator.rs
• rs/moq-auth/src/mesh/mod.rs
• rs/moq-auth/src/request.rs
• rs/workspace-hack/Cargo.toml
• sh/gh/nightly.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 7f49b06

No actionable bugs found in the changed areas and relevant surrounding code. The migration stays focused: it retains the JWK/DER boundary, rejects mismatched EC private/public material, and supplies each HTTP client an explicit TLS configuration. Keeping TLS configuration local to the client is preferable to selecting a process-wide rustls default; the small shared crypto helper is proportionate. The documented API breaks and CPU requirement are consistent with this direction.

Verification: static GitHub source/diff review, including key import/generation, signing/verification, mesh crypto and client initialization. I did not run tests, builds or benchmarks, reproduce the reported measurements, or independently audit the released rind implementations; this is not a claim that those checks passed.

(Written by OpenAI)

[pullfrog]

ℹ️ No critical issues. One minor process gap noted below.

Reviewed changes

This migrates all of moq-auth's JWT signing and verification, key generation, and JWK loading from aws-lc-rs / p256 / p384 onto the pure-Rust rind crate.

• JWT crypto on rind. jsonwebtoken loses its aws_lc_rs backend and never enables rust_crypto; new crypto::init() runs rind::cpu::check() (surfacing the new Error::UnsupportedCpu) then installs rind_jsonwebtoken::DEFAULT_PROVIDER unless the process already picked one. Both Key constructors, Key::generate and Jwk::import, call it first.
• Key generation and signing. HMAC, RSA, EC, and Ed25519 keys are generated from rind; RSA keeps reading its components out of PKCS#8/PKCS#1 through pkcs8/pkcs1. EC signing loads the JWK's x/y/d through EcdsaKeyPair::from_private_key_and_public_key and Ed25519 through from_seed_and_public_key, so an EC private JWK whose d mismatches its x/y is now refused at signing.
• Mesh on rind. Challenge HMAC, SHA-256, constant-time compare, random bytes, and Ed25519 verification run on rind, and mesh::Signer is implemented for rind::signature::Ed25519KeyPair in place of aws-lc's.
• reqwest TLS. Switched to rustls-no-provider, with crypto::tls() building a rind-rustls config (platform roots) that Client::new(url, None) and mesh::Client always hand reqwest.
• API and bench. Removed KeyError::MissingEcX/MissingEcY and the aws-lc/p256 From impls, added Error::UnsupportedCpu(String), and added the jwt Criterion bench to the CodSpeed set. Quest files updated.

The crypto migration reads clean: I checked rind 0.1.2's encoding contract (public_key() is an X9.62 uncompressed point, to_scalar()/to_seed() are fixed-length big-endian), so the x/y split in generate_ec_key and the reconstructed point in to_encoding_key are byte-correct for P-256 and P-384, and the root set is unchanged from reqwest's prior default (0.13's rustls feature also uses rustls-platform-verifier).

ℹ️ Missing rs/moq-auth/MIGRATE.md entry

This PR is feat(auth)! and breaks released API: it removes From<aws_lc_rs::error::…> and From<p256::…>, removes KeyError::MissingEcX/MissingEcY, and switches mesh::Signer's impl from aws-lc's Ed25519KeyPair to rind's. The repo convention (root AGENTS.md: "Feature PRs add their migration notes under ## Unreleased") was followed by every prior breaking auth PR, but this one does not touch rs/moq-auth/MIGRATE.md. The ## Impact bullets in the PR body are the source text; they just need to land in the file's ## Unreleased section before the release cut reconstructs a version section from it.

Technical details

# Add the moq-auth migration note for the rind switch

## Affected sites
- `rs/moq-auth/MIGRATE.md` — no `## Unreleased` entry describes the aws-lc to rind switch.

## Required outcome
- A new `### ...` subsection under `## Unreleased` in `rs/moq-auth/MIGRATE.md` describing the breaking changes and their migration, consistent in voice with the existing entries (for example the `### RSA uses aws-lc-rs (#6898)` entry directly below).

## Suggested approach
- Source the text from this PR's `## Impact` bullets: the removed `From<aws_lc_rs::error::{Unspecified, KeyRejected}>` and `From<p256::elliptic_curve::{Error, pkcs8::Error}>` impls, the removed `KeyError::MissingEcX`/`MissingEcY`, the `mesh::Signer` impl moving to `rind::signature::Ed25519KeyPair`, the new `Error::UnsupportedCpu`, and the `Client::new(url, None)` / `mesh::Client` provider and roots behavior.
- Precedent: every breaking auth PR to date added its `## Unreleased` entry in the same PR (#6898, #6778, #6510, #6471, #5765, #5996); a non-breaking `feat(auth)` PR (#7303) correctly added none.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[kixelated]

Fixed in 4d2fe26, the MIGRATE finding: rs/moq-auth/MIGRATE.md gets a Crypto runs on rind (#7570) entry under ## Unreleased that covers the removed From impls, the removed KeyError::MissingEcX/MissingEcY, Error::UnsupportedCpu, EC JWKs whose d doesn't match x/y, provider installation, and Client::new(url, None)'s TLS. The #6898 entry is now titled Private RSA JWKs are complete, since RSA no longer runs on aws-lc-rs. The entry leaves out mesh::Signer's impl change because mesh was never released (moq-auth 0.2.1 has no mesh module).

(Written by Claude Opus 5.5)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: c8c1c79

No new actionable issue found. Accounting for main's kio and benchmark changes, the separate CodSpeed invocation avoids the ambiguous package selector, and the migration notes record the breaking API changes.

Static GitHub inspection only; I did not build dependents, run tests or benchmarks, or audit rind.

[pullfrog]

ℹ️ No critical issues — one minor doc-command correction inline.

Reviewed changes

Re-reviewed the commits since the prior Pullfrog review at 7f49b06: the CodSpeed wiring for the new bench, the workspace-hack feature sync, and the migration notes.

• jwt bench wired into CodSpeed. rs/justfile drops -p moq-auth/--bench jwt from the main build and adds a second cargo codspeed build from rs/moq-auth, since cargo-codspeed takes no --manifest-path and -p moq-auth is ambiguous against its published dev-dependency.
• workspace-hack syncs jsonwebtoken's aws_lc_rs feature. The regenerated hack lifts the feature moq-auth's dev-dependencies still enable; every member dev-depends on the hack, so it reaches only test and lint builds, and crypto::tests::installs_rind_when_none_is_installed pins rind as the provider.
• Migration note added. rs/moq-auth/MIGRATE.md gains ### Crypto runs on rind (#7570), covering the removed From impls and KeyError variants, Error::UnsupportedCpu, the EC d-mismatch refusal, the provider install, and the client TLS behavior; the #6898 heading is retitled. This resolves the prior review's finding.
• Main merges. eb9afcce5/c8c1c796a bring main's verify bench and kio manual feature alongside the branch's jwt bench and async feature.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

This invocation fails: moq-auth's published release is its own dev-dependency, so cargo bench -p moq-auth --bench jwt errors with specification `moq-auth` is ambiguous — the exact reason rs/justfile now builds this bench from rs/moq-auth. Use the form the nightly script uses (cargo bench --manifest-path rs/moq-auth/Cargo.toml --bench jwt, see sh/gh/nightly.sh:133) or run cargo bench --bench jwt from this directory. The PR body's Measurements line quotes the same ambiguous command.

Suggested change

	//! Run with `cargo bench -p moq-auth --bench jwt`.
	//! Run with `cargo bench --manifest-path rs/moq-auth/Cargo.toml --bench jwt`.

[moq-bot]

quest land watch: the merge queue removed this pull request at c8c1c79 because its merge_group build failed (failed_checks).

The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs.

Queue / Queue (job) failure at step Check:

…e2ee)
 Documenting libmoq v0.6.12 (/var/cache/github-runner-work/moq/moq/rs/libmoq)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 36.03s
   Generated /var/cache/github-runner-work/moq/moq/target/doc/bench_harness/index.html and 42 other files
mbx[cache]: object cache: 611 hits, 11 misses, 14 not looked up, 44 bypassed; 0 B downloaded, 0 B uploaded, 41.1 MiB stored locally
mbx[cache]: 36.62s session; 19m 57s estimated compiler time avoided (summed across compilations)
mbx[cache]: 14 compilations had no usable prior inputs or matching prediction for a lookup
mbx[cache]: bypass reasons: 43 rustdoc, 1 unsupported-crate-type
mbx[cache]: Cargo artifact reuse and CI cache archive transfers are not included above
mbx[savings]: found 4.6 TiB logical of target/ whose checkouts left long ago. the estate has been settled.
cargo shear
##[warning]25 unlinked files in `kio`
macros/tests/ui/branch_wait.rs
macros/tests/ui/break_outside_loop.rs
macros/tests/ui/duplicate_wait.rs
macros/tests/ui/every_poll_late.rs
macros/tests/ui/generic.rs
macros/tests/ui/hidden_borrow.rs
macros/tests/ui/hidden_turbofish.rs
macros/tests/ui/hidden_yield.rs
macros/tests/ui/missing_try.rs
macros/tests/ui/not_send.rs
macros/tests/ui/poll_moves.rs
macros/tests/ui/poll_type.rs
macros/tests/ui/segment_type.rs
macros/tests/ui/self_borrow.rs
macros/tests/ui/untyped.rs
macros/tests/ui/wrapper_moved_argument.rs
macros/tests/ui/wrapper_name.rs
macros/tests/ui/wrapper_no_receiver.rs
macros/tests/ui/wrapper_output.rs
macros/tests/ui/wrapper_owned_receiver.rs
macros/tests/ui/wrapper_pattern.rs
macros/tests/ui/wrapper_qualifiers.rs
macros/tests/ui/wrapper_unnameable.rs
macros/tests/ui/wrapper_waiter.rs
macros/tests/ui/wrong_annotation.rs (delete these files)
##[warning]redundant ignore `kio` (remove from ignored list)
##[warning]25 unlinked files in `kio-macros`
tests/ui/branch_wait.rs
tests/ui/break_outside_loop.rs
tests/ui/duplicate_wait.rs
tests/ui/every_poll_late.rs
tests/ui/generic.rs
tests/ui/hidden_borrow.rs
tests/ui/hidden_turbofish.rs
tests/ui/hidden_yield.rs
tests/ui/missing_try.rs
tests/ui/not_send.rs
tests/ui/poll_moves.rs
tests/ui/poll_type.rs
tests/ui/segment_type.rs
tests/ui/self_borrow.rs
tests/ui/untyped.rs
tests/ui/wrapper_moved_argument.rs
tests/ui/wrapper_name.rs
tests/ui/wrapper_no_receiver.rs
tests/ui/wrapper_output.rs
tests/ui/wrapper_owned_receiver.rs
tests/ui/wrapper_pattern.rs
tests/ui/wrapper_qualifiers.rs
tests/ui/wrapper_unnameable.rs
tests/ui/wrapper_waiter.rs
tests/ui/wrong_annotation.rs (delete these files)
##[warning]1 unlinked file in `moq-audio`
src/decode/conformance.rs (delete this file)
# The workspace-hack's table order is `cargo hakari`'s, which `cargo sort` disagrees with.
cargo sort --check --no-format . $(cargo metadata --locked --no-deps --format-version 1 | jq -r '.packages[] | select(.name != "workspace-hack") | .manifest_path | rtrimstr("/Cargo.toml")')
Checking ....
Checking bridge...
Checking moq-mux...
Checking hang...
Checking kio...
Checking macros...
Checking test-env...
Checking bench-harness...
Checking moq-json...
Checking moq-net...
Checking moq-pattern...
Checking moq-tokio...
Checking moq-congestion...
Checking moq-ice...
Checking moq-quic...
Checking moq-sock...
Checking qmux...
Checking moq-shaper...
Checking moq-loc...
Checking moq-msf...
Checking moq-video...
Checking moq-nvenc...
Checking moq-v4l...
Checking libmoq...
Checking moq-archive...
Checking moq-audio...
Checking moq-auth...
Checking moq-bench...
Checking moq-uring...
Checking moq-boy...
Checking moq-c...
Checking moq-cli...
Checking moq-hls...
Checking moq-relay...
Checking moq-stats...
Checking moq-rtc...
Checking moq-rtmp...
Checking moq-rtsp...
Checking moq-srt...
Checking moq-transcode...
Checking moq-e2ee...
Checking moq-ffi...
Checking moq-gst...
Checking moq-native...
Checking moq-net-tests...
Checking moq-room...
Checking moq-sign...
Checking uniffi-bindgen...
Checking fuzz...
Checking fuzz...
Checking fuzz...
Checking fuzz...
cargo hakari generate --diff
python3 sh/rs/hakari.py
##[endgroup]
##[group]test rs
sh/rs/select.sh test "$LIST"
rs: selecting the workspace
CARGO_BUILD_WARNINGS=deny RUSTC_WORKSPACE_WRAPPER='/nix/store/4klbl675argl2irhl89zrh2n14wilzx9-rust-minimal-1.98.1/bin/clippy-driver' bash sh/rs/nextest.sh cargo nextest run --locked --tests "$@"
   Compiling glob v0.3.4
   Compiling kio-macros v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/kio/macros)
   Compiling moq-pattern v0.1.2 (/var/cache/github-runner-work/moq/moq/rs/moq-pattern)
   Compiling clang-sys v1.9.1
   Compiling moq-sock v0.2.0 (/var/cache/github-runner-work/moq/moq/rs/moq-sock)
   Compiling bench-harness v0.0.1 (/var/cache/github-runner-work/moq/moq/rs/bench-harness)
   Compiling moq-msf v0.5.1 (/var/cache/github-runner-work/moq/moq/rs/moq-msf)
   Compiling test-env v0.0.1 (/var/cache/github-runner-work/moq/moq/rs/test-env)
   Compiling rind-jsonwebtoken v0.1.2
   Compiling bindgen v0.72.1
   Compiling bindgen v0.70.1
   Compiling libspa-sys v0.10.1
   Compiling pipewire-sys v0.10.1
   Compiling moq-vaapi v0.1.0
   Compiling moq-video v0.1.10 (/var/cache/github-runner-work/moq/moq/rs/moq-video)
   Compiling moq-nvenc v0.1.2 (/var/cache/github-runner-work/moq/moq/rs/moq-nvenc)
   Compiling moq-v4l v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/moq-v4l)
   Compiling libspa v0.10.1
   Compiling target-tuple v1.0.2
   Compiling moq-gst v0.4.12 (/var/cache/github-runner-work/moq/moq/rs/moq-gst)
   Compiling termcolor v1.4.1
   Compiling trybuild v1.0.122
   Compiling syn v2.0.119
   Compiling moq-c v0.7.0 (/var/cache/github-runner-work/moq/moq/rs/moq-c)
mbx[warning]: result was not stored: rustc search path kind is not cacheable yet: native
   Compiling derive_arbitrary v1.5.0
   Compiling cpu-time v1.0.0
   Compiling arbitrary v1.5.0
   Compiling stats_alloc v0.1.10
   Compiling assert_matches v1.5.0
   Compiling hex-literal v1.1.0
   Compiling pipewire v0.10.1
   Compiling kio v0.6.2 (/var/cache/github-runner-work/moq/moq/rs/kio)
   Compiling moq-net v0.3.10 (/var/cache/github-runner-work/moq/moq/rs/moq-net)
   Compiling moq-congestion v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/moq-congestion)
   Compiling moq-ice v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/moq-ice)
   Compiling moq-shaper v0.0.1 (/var/cache/github-runner-work/moq/moq/rs/moq-shaper)
   Compiling moq-auth v0.2.1 (/var/cache/github-runner-work/moq/moq/rs/moq-auth)
   Compiling moq-auth v0.2.1
   Compiling workspace-hack v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/workspace-hack)
   Compiling moq-quic v0.1.0 (/var/cache/github-runner-work/moq/moq/rs/moq-quic)
   Compiling moq-native v0.20.0 (/var/cache/github-runner-work/moq/moq/rs/moq-native)
   Compiling libmoq v0.6.12 (/var/cache/github-runner-work/moq/moq/rs/libmoq)
   Compiling moq-json v0.5.8 (/var/cache/github-runner-work/moq/moq/rs/moq-json)
   Compiling qmux v0.7.0 (/var/cache/github-runner-work/moq/moq/rs/qmux)
   Compiling moq-loc v0.2.19 (/var/cache/github-runner-work/moq/moq/rs/moq-loc)
   Compiling moq-uring v0.0.12 (/var/cache/github-runner-work/moq/moq/rs/moq-uring)
   Compiling moq-tokio v0.19.23 (/var/cache/github-runner-work/moq/moq/rs/moq-tokio)
   Compiling hang v0.21.11 (/var/cache/github-runner-work/moq/moq/rs/hang)
   Compiling moq-stats v0.2.12 (/var/cache/github-runner-work/moq/moq/rs/moq-stats)
   Compiling moq-archive v0.0.11 (/var/cache/github-runner-work/moq/moq/rs/moq-archive)
   Compiling moq-mux v0.10.11 (/var/cache/github-runner-work/moq/moq/rs/moq-mux)
   Compiling moq-e2ee v0.0.11 (/var/cache/github-runner-work/moq/moq/rs/moq-e2ee)
error: recipe `test-changed` was terminated on line 86 by signal 15
##[endgroup]
##[error]ci: test gh failed
     8  check markdown
    10  check gh
    45  test gh (failed)
    32  check flake
     0  check drill
     3  check quest
     1  check ts_paths
    12  check shell
     0  check large_files
     1  check toml
     0  check nix
     0  check justfile
    67  wall time
error: recipe `ci` failed on line 107 with exit code 1
##[error]Process completed with exit code 1.
##[group]Run actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
with:
  name: cargo-timings
  path: target/cargo-timings/cargo-timing-*.html
  if-no-files-found: ignore
  retention-days: 14
  compression-level: 6
  overwrite: false
  include-hidden-files: false
  archive: true
env:
  BASE: 7ed14bb258027e81c57348e64fc351a9e53a5983
  CHECK_FAIL_FAST: 1
  NEXTEST_TEST_THREADS: 24
  MBX_CACHE_LINKS: 1
  MBX_REMOTE_URL: 
##[endgroup]
With the provided path, there will be 2 files uploaded
Artifact name is valid!
Root directory input is valid!
Uploading artifact: cargo-timings.zip
Beginning upload of artifact content to blob storage
Uploaded bytes 124824
Finished uploading artifact content to blob storage!
SHA256 digest of uploaded artifact is 9ab5e31f89755986165ec440677b5c9a428fd5cdd54fdc7f9da9c30b23a1d77f
Finalizing artifact upload
Artifact cargo-timings successfully finalized. Artifact ID 13214085380
Artifact cargo-timings has been successfully uploaded! Final size is 124824 bytes. Artifact ID is 13214085380
Artifact download URL: https://github.com/moq-dev/moq/actions/runs/41598435535/artifacts/13214085380
Post job cleanup.
##[start-action display=Run jdx/mr-boxington-action@47ce49b32025d93a7a2f4570815afaa2b7092240;id=__6105f854-6140-43ab-83f5-69b8ce323080.mbx]
##[end-action id=__6105f854-6140-43ab-83f5-69b8ce323080.mbx;outcome=skipped;conclusion=skipped;duration_ms=0]
Post job cleanup.
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git version
git version 2.55.0
Temporarily overriding HOME='/var/cache/github-runner-work/_temp/a48b7ecd-30d3-4a90-b49a-4ff554797a1f' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git config --global --add safe.directory /var/cache/github-runner-work/moq/moq
Removing SSH command configuration
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
[command]/nix/store/lg46w7hrjx7kylsh6645c9l975i8h43b-git-2.55.0/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
A job completed hook has been configured by the self-hosted runner administrator
##[group]Run '/nix/store/gx2v6q84b0w43bafm0whkdx93qyxbpps-ci-cache-gc.sh/bin/ci-cache-gc.sh'
shell: /nix/store/1mv3qz005gkbalxfghk4y3s8ayv4d2dl-bash-interactive-5.3p15/bin/bash --noprofile --norc -e -o pipefail {0}
##[endgroup]
evicted 3 objects and 1 action results (432.6 MiB logical); 49.6 GiB logical remain
dropped 2 stale checkout records
dropped 7 session event streams
removed 0 learned incremental units and 2 checkout directories (3.7 KiB logical); 28 units (4.5 GiB logical) remain
evicted 0 objects and 0 action results (0 B logical); 49.6 GiB logical remain
removed 2 target directories (13.7 MiB logical, 2 abandoned and 0 live); 15.8 GiB logical remain
Cleaning up orphan processes

(written by quest land watch)

[moq-bot]

codex / Codex land fixer note:

The new jwt benchmark was absent from the Nightly benchmark inventory, causing test_every_cargo_bench_target_runs_nightly to fail. Merged the current base without conflicts and added --bench jwt to the existing auth Nightly invocation. All 14 Nightly tests, 267 auth tests including doctests, both benchmark smoke runs, and the auth build passed. Shell syntax, lint, and formatting checks passed. Runtime code was unchanged by the fix.

(written by codex / Codex)

[moq-bot]

quest land watch: re-enqueued this pull request at 77fd681, at the back of the merge queue, with the land fixer's fix (codex / Codex): Merged base cleanly and registered the existing jwt bench in Nightly; passed python3 sh/gh/nightly.test.py, bash -n sh/gh/nightly.sh, shellcheck sh/gh/nightly.sh, shfmt -d sh/gh/nightly.sh; with locally installed libraries configured via python3 /tmp/quest-land-build-env.py, passed cargo build --locked --manifest-path rs/moq-auth/Cargo.toml --all-features --all-targets, cargo test --locked --manifest-path rs/moq-auth/Cargo.toml --all-features, and cargo test --locked --manifest-path rs/moq-auth/.

(written by quest land watch)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 77fd681, compared with c8c1c79.

The nightly registration preserves the existing verification benchmark and adds JWT using an unambiguous manifest path. No new actionable bugs found in this update; the earlier independent comment about the command in jwt.rs remains relevant. Static review only; I did not run the benchmark or CI.

[pullfrog]

ℹ️ No new issues in this incremental change.

Reviewed changes

Re-reviewed the commits since the prior Pullfrog review at c8c1c79: a merge of main and the Nightly registration of the new jwt bench.

• jwt bench registered in Nightly. sh/gh/nightly.sh appends --bench jwt to the existing rust-extra auth criterion invocation, so test_every_cargo_bench_target_runs_nightly now covers the new target. One cargo bench --manifest-path rs/moq-auth/Cargo.toml --bench verify --bench jwt builds both moq-auth benches, and criterion_build_base filters jwt out of a paired base that predates it, reporting it as new rather than failing the base build.
• main merge. 8b2f76011 brings main up to 7ed14bb25 with no net change to the PR's own diff.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}