workspace,workspace_tests,toml_test_utils: pin privacy-circuit-verify-v1 to an immutable rev

[gkaempfer]

Summary

Automated security scan of #15120 (merged), which reintroduced the privacy-circuit-verify-v1 proof-verification circuit as a dependency.

That dependency was added pinned by a mutable git tag:

privacy-circuit-verify-v1 = { package = "privacy-circuit-verify", git = "https://github.com/starkware-libs/proving-utils", tag = "v0.14.3-rust-bump" }

Every other git dependency in the workspace (privacy-circuit-verify-v2, privacy-prove) is pinned by an immutable commit rev instead. A git tag is not immutable: it can be moved to a different commit upstream — deliberately, by mistake, or via a compromised starkware-libs/proving-utils repository — and a later cargo update -p privacy-circuit-verify-v1 (or a fresh lockfile resolution) would silently pull in different code for this security-critical cryptographic proof-verification path, with no corresponding Cargo.toml diff for a reviewer to catch. Cargo.lock currently pins the resolved commit, but that protection only holds until the lockfile entry is next regenerated.

This is a supply-chain integrity risk (OWASP A08:2021 – Software and Data Integrity Failures / CWE-829).

Changes

• Cargo.toml: repin privacy-circuit-verify-v1 to rev = "3035dd00421daa541894297bd754db6e2787807b" — the exact commit the tag already resolved to in Cargo.lock — instead of tag = "v0.14.3-rust-bump". No code or resolved-dependency-graph change; only the Cargo.lock source URL's ref-type changes from ?tag=... to ?rev=....
• toml_test_utils: capture tag/branch fields on DependencyValue::Object so the workspace-lint tests can see them.
• workspace_tests: add test_git_dependencies_pinned_to_immutable_rev, asserting no workspace git dependency is pinned by a mutable tag/branch ref. Verified this test fails (naming privacy-circuit-verify-v1) against the pre-fix Cargo.toml, and passes after the fix.

Testing

• cargo test -p workspace_tests: 18/18 pass (new test included).
• cargo metadata --locked: succeeds against the updated Cargo.lock, confirming the lockfile is still consistent with Cargo.toml.
• scripts/rust_fmt.sh and cargo clippy -p workspace_tests -p toml_test_utils --all-targets -- -D warnings: clean.
• Confirmed the new test fails (naming the offending dependency) when run against the original tag-pinned Cargo.toml, and passes after repinning to rev.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BXBpvrNnCRkjd35DuaUYa7

---

Generated by Claude Code

[cursor]

PR Summary

Low Risk
Supply-chain hardening only: same resolved commit, no runtime or verification logic changes.

Overview
Repins privacy-circuit-verify-v1 from a mutable git tag to commit rev 3035dd0…, matching what Cargo.lock already resolved—so proof-verification code cannot change silently on cargo update without a Cargo.toml diff.

Adds test_git_dependencies_pinned_to_immutable_rev in workspace_tests (with toml_test_utils extended to parse tag/branch) to block future workspace git deps that lack an immutable rev. commitlint gains the toml_test_utils scope.

^{Reviewed by Cursor Bugbot for commit ec752cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[github-actions]

Artifacts upload workflows:

• Started at 2026-09-15T07:00:53Z

[gkaempfer]

Two CI checks failed on ec752cb (merge-gatekeeper-new is downstream of these, not a separate cause):

• starknet_transaction_prover_ci: the test binary ran 148 tests successfully and was then killed by SIGKILL (signal 9) — an OOM/resource kill on the runner, not a test assertion failure. This PR touches no code in starknet_transaction_prover (only Cargo.toml/Cargo.lock's dependency-pin format, toml_test_utils, and workspace_tests), so this isn't this PR's failure. Re-run queued.
• benchmarking: transfers_sequential_benchmark_vm came in +28% over its wall-clock threshold. This PR doesn't touch blockifier or any execution code, so this is shared-runner timing noise, not a regression from this diff. A re-run attempt hit "workflow is already running" (other jobs in that run were still in progress); will re-run once it finishes.

Will report back if either fails again on re-run.

---

Generated by Claude Code