chore: bump to v1.0.0-rc.0, implement zeroize for deps and license fix

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.0-rc.0 (July 2, 2026)
+
+* Added missing license in Cargo manifest
+* Implement `zeroize` feature for `digest`, `hybrid-array` and `sha2`
+* Replaced license appendix in files while keeping original copyright
+
 ## 1.0.0-pre.1 (July 2, 2026)
 
 * Simplified ciphersuite trait

Cargo.toml

@@ -4,12 +4,12 @@ categories = ["no-std", "algorithms", "cryptography"]
 description = "An implementation of a verifiable oblivious pseudorandom function (VOPRF)"
 edition = "2024"
 keywords = ["oprf", "voprf", "cryptography", "oblivious-prf"]
-license = "MIT"
+license = "MIT OR Apache-2.0"
 name = "voprf-vx"
 readme = "README.md"
 repository = "https://github.com/vexahub/voprf-vx/"
 rust-version = "1.87"
-version = "1.0.0-pre.1"
+version = "1.0.0-rc.0"
 
 [features]
 alloc = []
@@ -24,18 +24,18 @@ std = ["alloc"]
 [dependencies]
 curve25519-dalek = { version = "5.0.0-rc", default-features = false, features = ["rand_core", "zeroize"], optional = true }
 derive-where = { version = "1", features = ["zeroize-on-drop"] }
-digest = "0.11"
+digest = { version = "0.11", features = ["zeroize"] }
 displaydoc = { version = "0.2", default-features = false }
 elliptic-curve = { version = "0.14", features = [
     "sec1",
 ] }
 hash2curve = "0.14"
-hybrid-array = "0.4"
-rand_core = { version = "0.10", default-features = false, features = [] }
+hybrid-array = { version = "0.4", features = ["zeroize"] }
+rand_core = { version = "0.10", default-features = false }
 serde = { version = "1", default-features = false, features = [
     "derive",
 ], optional = true }
-sha2 = { version = "0.11", default-features = false, optional = true }
+sha2 = { version = "0.11", default-features = false, features = ["zeroize"], optional = true }
 p256 = { version = "0.14.0-rc", default-features = false, features = ["hash2curve", "oprf"], optional = true }
 subtle = { version = "2.6", default-features = false }
 zeroize = { version = "1.5", default-features = false }

README.md

@@ -16,7 +16,7 @@ Installation
 Add the following line to the dependencies of your `Cargo.toml`:
 
 ```
-voprf = { package = "voprf-vx", version = "1.0.0-pre.0" }
+voprf = { package = "voprf-vx", version = "1.0.0-rc.0" }
 ```
 
 ### Minimum Supported Rust Version

src/ciphersuite.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Defines the CipherSuite trait to specify the underlying primitives for VOPRF
 

src/common.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Common functionality between multiple OPRF modes.
 

src/error.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Errors which are produced during an execution of the protocol
 

src/group/elliptic_curve.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 use core::ops::{Add, Mul};
 use digest::block_api::BlockSizeUser;

src/group/mod.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Defines the Group trait to specify the underlying prime order group
 

src/group/ristretto.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 use core::num::NonZeroU16;
 

src/group/tests.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Includes a series of tests for the group implementations
 

src/lib.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! An implementation of a verifiable oblivious pseudorandom function (VOPRF)
 //!

src/oprf.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Contains the main OPRF API
 

src/poprf.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Contains the main POPRF API
 

src/serialization.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Handles the serialization of each of the components used in the VOPRF
 //! protocol

src/tests/cfrg_vectors.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! The VOPRF test vectors taken from:
 //! https://www.rfc-editor.org/rfc/rfc9497#appendix-A

src/tests/mock_rng.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 use alloc::vec::Vec;
 use core::cmp::min;

src/tests/mod.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 mod cfrg_vectors;
 mod mock_rng;

src/tests/parser.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 use alloc::string::{String, ToString};
 use alloc::vec::Vec;

src/tests/test_cfrg_vectors.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 use alloc::string::String;
 use alloc::vec;

src/voprf.rs

@@ -1,10 +1,6 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+// Copyright (c) VexaHub and contributors.
 // Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
 
 //! Contains the main VOPRF API