Prepare hashavatar 0.12.0

Expand avatar families and harden identity, encoding, and fuzzing controls.

Author: eldryoth

CHANGELOG.md

@@ -41,7 +41,9 @@
   and explicitly zeroized BLAKE3 hasher/XOF reader state after digest
   derivation.
 - Wrapped digest-derived renderer RNG seed copies in `zeroize::Zeroizing` so
-  the temporary mixed seed is scrubbed after RNG initialization.
+  the temporary mixed seed is scrubbed immediately after RNG initialization,
+  and documented `StdRng`'s non-zeroized expanded internal state as a known
+  residual.
 - Wrapped owned RGBA encode buffers and JPEG RGB flattening buffers in RAII
   zeroization guards so temporary pixel data is scrubbed during normal returns,
   encoder errors, and unwinding panics.

docs/SECURITY_CONTROLS.md

@@ -37,8 +37,15 @@
   digest, separate from the lower digest bytes commonly used for direct visual
   parameters.
 - The temporary 256-bit RNG seed copy is stored in `zeroize::Zeroizing`, so the
-  digest-derived seed copy is scrubbed when it leaves scope after seeding the
-  renderer RNG.
+  digest-derived seed copy is scrubbed immediately after seeding the renderer
+  RNG.
+- The procedural RNG itself is `rand::rngs::StdRng`. Its expanded internal
+  state is not zeroized on drop because `StdRng` does not currently implement
+  `ZeroizeOnDrop`. In the default SHA-512 mode, recovering the original
+  identity from that expanded state would require reversing SHA-512 output,
+  which is computationally infeasible. High-assurance callers should still
+  treat this as a known residual and prefer SHA-512 or BLAKE3 over XXH3 for
+  sensitive identifiers.
 - `AvatarIdentity` equality uses constant-time digest comparison.
 - `AvatarIdentity` has a redacted `Debug` implementation so accidental
   `{:?}` logging does not print the raw digest.

docs/release-notes/RELEASE_NOTES_0.12.0.md

@@ -61,8 +61,9 @@ single, asset-free image-generation crate.
   BLAKE3 hasher plus XOF reader are explicitly zeroized after digest
   derivation.
 - Digest-derived renderer RNG seed copies are now wrapped in
-  `zeroize::Zeroizing`, so the temporary mixed seed is scrubbed after RNG
-  initialization.
+  `zeroize::Zeroizing`, so the temporary mixed seed is scrubbed immediately
+  after RNG initialization. The security controls also document `StdRng`'s
+  non-zeroized expanded internal state as a known residual.
 - Owned RGBA encode buffers and JPEG RGB flattening buffers now use RAII
   zeroization guards, so temporary pixel data is scrubbed during normal
   returns, encoder errors, and unwinding panics.

src/lib.rs

@@ -4156,16 +4156,24 @@ pub fn render_cat_avatar_for_identity_with_background(
     Ok(render_cat_avatar_with_identity(spec, identity, background))
 }
 
+fn seeded_renderer_rng(spec: AvatarSpec, identity: &AvatarIdentity) -> StdRng {
+    let mut rng_seed = identity.rng_seed();
+    for (index, byte) in spec.seed.to_le_bytes().iter().enumerate() {
+        rng_seed[index] ^= *byte;
+    }
+    let mut rng_seed_value = *rng_seed;
+    drop(rng_seed);
+    let rng = StdRng::from_seed(rng_seed_value);
+    rng_seed_value.zeroize();
+    rng
+}
+
 fn render_cat_avatar_with_identity(
     spec: AvatarSpec,
     identity: &AvatarIdentity,
     background: AvatarBackground,
 ) -> RgbaImage {
-    let mut rng_seed = identity.rng_seed();
-    for (index, byte) in spec.seed.to_le_bytes().iter().enumerate() {
-        rng_seed[index] ^= *byte;
-    }
-    let mut rng = StdRng::from_seed(*rng_seed);
+    let mut rng = seeded_renderer_rng(spec, identity);
     let genome = CatGenome::from_identity(identity, &mut rng);
     let palette = CatPalette::from_genome(&genome);
     let mut image = ImageBuffer::from_pixel(
@@ -9895,6 +9903,25 @@ mod tests {
         assert_eq!(rng_seed.len(), 32);
     }
 
+    #[test]
+    fn renderer_rng_seed_copy_is_zeroized_before_rng_use() {
+        let source = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/src/lib.rs"));
+        let helper = source
+            .split("fn seeded_renderer_rng")
+            .nth(1)
+            .and_then(|after_name| {
+                after_name
+                    .split("fn render_cat_avatar_with_identity")
+                    .next()
+            })
+            .expect("seeded renderer rng helper should exist");
+
+        assert!(helper.contains("let mut rng_seed_value = *rng_seed;"));
+        assert!(helper.contains("drop(rng_seed);"));
+        assert!(helper.contains("let rng = StdRng::from_seed(rng_seed_value);"));
+        assert!(helper.contains("rng_seed_value.zeroize();"));
+    }
+
     #[test]
     fn avatar_identity_equality_compares_digest_values() {
         let left = valid_identity("alice@example.com");