security: feature-gate ML-DSA / SLH-DSA behind pq-experimental (#72)

The ml-dsa 0.0.4 crate carries open timing-side-channel and implementation
advisories (RUSTSEC-2025-0144, CVE-2026-22705, CVE-2026-24850,
GHSA-h37v-hp6w-2pp8). Default builds now resolve without ml-dsa at all —
operators who want post-quantum signing opt in explicitly:

    cargo build --features pq-experimental

Changes:
- Cargo.toml: ml-dsa = { ..., optional = true }; add pq-experimental feature
- signer.rs: cfg-gate ml-dsa import, PrivateKey::MlDsa* variants, and every
  match arm / parse branch that references them; error message conditional
- pkcs7/builder.rs: cfg-gate SigningAlgorithm::MlDsa* + SlhDsa* variants,
  algorithm_id / digest_algorithm arms, and the six PQC unit tests
- tests/pq_feature_gate.rs: compile-time + dep-tree assertions that pin
  the gate — exhaustive matches break the build if a variant leaks, and
  `cargo tree --no-default-features --invert ml-dsa` must exit non-zero
- deny.toml: drop the ml-dsa CVE ignores (default graph is ml-dsa-free)
- ci.yml / daily-health.yml / release.yml: keep --ignore RUSTSEC-2025-0144
  for cargo audit (Cargo.lock still pins the optional dep, audit walks
  the lockfile regardless of features) with clarifying rationale
- README / CHANGELOG: document the feature flag and mark #72 shipped

closes #72

Co-Authored-By: Claude <noreply@anthropic.com>

Author: rayketcham

.github/workflows/ci.yml

@@ -281,7 +281,11 @@ jobs:
           git config --unset-all http.https://github.com/.extraheader || true
           git config --global --unset-all http.https://github.com/.extraheader || true
           for attempt in 1 2 3; do
-            cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2025-0144 --ignore RUSTSEC-2025-0134 --ignore CVE-2026-22705 --ignore CVE-2026-24850 --ignore GHSA-h37v-hp6w-2pp8 && break
+            # RUSTSEC-2025-0144 (ml-dsa timing) only affects `pq-experimental`
+            # builds — ml-dsa is feature-gated (gh #72) and absent from the
+            # default dep graph (verified by pq_feature_gate.rs). Ignored in
+            # audit because Cargo.lock still pins the crate for the opt-in feature.
+            cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2025-0134 --ignore RUSTSEC-2025-0144 && break
             echo "Attempt $attempt failed, retrying..."
             sleep 5
           done

.github/workflows/daily-health.yml

@@ -117,7 +117,8 @@ jobs:
           cargo audit 2>&1 || true
           echo ""
           echo "=== Audit with accepted ignores ==="
-          cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2025-0144 --ignore RUSTSEC-2025-0134
+          # RUSTSEC-2025-0144 = ml-dsa timing; pq-experimental-only (gh #72)
+          cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2025-0134 --ignore RUSTSEC-2025-0144
 
       - name: Run cargo deny
         env:

.github/workflows/release.yml

@@ -41,7 +41,17 @@ jobs:
       - name: Install cargo-audit
         run: cargo install --locked cargo-audit
       - name: cargo audit (RustSec advisories)
-        run: cargo audit --deny warnings
+        # Ignores must match ci.yml + daily-health.yml:
+        #   RUSTSEC-2023-0071 — rsa Marvin attack, oaep_decrypt exists but is not web-reachable (covered by security regression test)
+        #   RUSTSEC-2025-0134 — rustls-pemfile unmaintained, transitive via reqwest/rustls
+        #   RUSTSEC-2025-0144 — ml-dsa timing; pq-experimental-only (gh #72), absent from default dep graph
+        #   RUSTSEC-2026-0097 — rand unsound-with-custom-logger, transitive via rsa/quinn/p12-keystore, no custom logger used
+        run: >-
+          cargo audit --deny warnings
+          --ignore RUSTSEC-2023-0071
+          --ignore RUSTSEC-2025-0134
+          --ignore RUSTSEC-2025-0144
+          --ignore RUSTSEC-2026-0097
       - name: Install cargo-deny
         run: cargo install --locked cargo-deny
       - name: cargo deny (advisories, licenses, bans, sources)

CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Multipart streaming body-limit now returns 413** — uploads without a `Content-Length` header (chunked transfer-encoding) that exceed `max_upload_size` are rejected with `413 Payload Too Large` instead of `500 Internal Server Error`. The fix walks the multipart error source chain for `http_body_util::LengthLimitError` and maps it to `SignError::FileTooLarge`, closing the 500-leakage gap the pre-buffer layer left behind.
 - **Release ci-gate now runs cargo-audit + cargo-deny** — vulnerable dependencies can no longer ship via the release workflow, even if admin-bypass is used on `main`.
 - **Cosign signing failures now fail the release** — removed `|| echo` fallback on `gh release upload` and added a post-sign presence check for every `.sig`/`.cosign-bundle`. v0.5.8 shipped without supply-chain signatures because of this silent-fail; regression guard added.
-- **ml-dsa CVE cluster acknowledged in deny.toml + cargo audit** — CVE-2026-22705, CVE-2026-24850, GHSA-h37v-hp6w-2pp8 explicitly ignored with tracker link; no CI surprise when advisory DB catches up.
+- **ML-DSA / SLH-DSA moved behind `pq-experimental` feature flag (#72)** — the `ml-dsa` crate and all `PrivateKey::MlDsa*` / `SigningAlgorithm::MlDsa*` / `SigningAlgorithm::SlhDsa*` variants are now gated. The default build does not resolve `ml-dsa`, which removes RUSTSEC-2025-0144 (timing side-channel), CVE-2026-22705, CVE-2026-24850, and GHSA-h37v-hp6w-2pp8 from the default dep graph. `tests/pq_feature_gate.rs` asserts the invariant at CI time via exhaustive match + `cargo tree --no-default-features --invert ml-dsa`.
 - **rustls-webpki CVE floor regression test** — supply-chain test asserts locked version >= 0.103.12.
 
 ### Fixed
@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `test_exact_boundary_content_length_not_413` — off-by-one regression on `body == max_upload_size`.
 - `tests/supply_chain_regression.rs` — Cargo.lock version-floor assertions.
 - `tests/release_assets.rs` — README/release.yml asset-name drift guard.
+- `tests/pq_feature_gate.rs` — compile-time + dep-tree assertions for the `pq-experimental` gate.
 
 ## [0.5.8] - 2026-04-16
 

README.md

@@ -63,7 +63,7 @@ No OpenSSL. No `signtool.exe`. No external dependencies. One binary.
 - **Detached CMS/PKCS#7** --- Sign any file with a `.p7s` detached signature
 - **PowerShell signing** --- PS1 scripts with Base64 PKCS#7 signature blocks
 - **RFC 3161 timestamping** --- Counter-signatures for long-term validity
-- **Multi-algorithm** --- RSA (2048-4096), ECDSA P-256/P-384/P-521, Ed25519, ML-DSA-44/65/87
+- **Multi-algorithm** --- RSA (2048-4096), ECDSA P-256/P-384/P-521, Ed25519. Post-quantum (ML-DSA-44/65/87) opt-in via `--features pq-experimental`.
 - **Signature verification** --- Validate Authenticode and detached CMS signatures
 - **PFX/PKCS#12 import** --- Load signing credentials from `.pfx` files
 - **Web service mode** --- REST API for Code Signing as a Service
@@ -246,6 +246,7 @@ server = "CN=Server Signers,OU=Groups,DC=corp,DC=example,DC=com"
 |--------|------|-------------|
 | `POST` | `/api/v1/sign` | Upload and sign a file (multipart) |
 | `POST` | `/api/v1/sign-detached` | Create detached CMS signature |
+| `POST` | `/api/v1/sign-batch` | Sign up to 10 files, return a ZIP + `signing_summary.csv` |
 | `POST` | `/api/v1/verify` | Verify an Authenticode signature |
 | `POST` | `/api/v1/verify-detached` | Verify a detached signature |
 | `GET` | `/api/v1/status` | Server status and statistics |
@@ -284,6 +285,26 @@ curl -X POST https://sign.example.com/api/v1/sign \
 
 </details>
 
+<details>
+<summary><strong>Batch sign (curl)</strong></summary>
+
+```bash
+# Upload up to 10 files in a single request; response is a ZIP archive
+curl -X POST https://sign.example.com/api/v1/sign-batch \
+  -H "X-Remote-User: jdoe" \
+  -F "file=@app1.exe" \
+  -F "file=@app2.dll" \
+  -F "file=@installer.msi" \
+  -F "cert_type=desktop" \
+  -o signed-batch.zip
+
+# The ZIP contains signed_<name> for each input plus signing_summary.csv
+# with columns: file, status, algorithm, timestamped, duration_ms, error
+unzip -l signed-batch.zip
+```
+
+</details>
+
 <details>
 <summary><strong>Detached signature (curl)</strong></summary>
 
@@ -465,7 +486,7 @@ COMMANDS:
 
 ## Security
 
-- **No OpenSSL** --- Pure Rust crypto stack (`rsa`, `p256`, `p384`, `p521`, `ed25519-dalek`, `ml-dsa`, `sha2`, `aes-gcm`). TLS via `rustls` with `aws-lc-rs` backend.
+- **No OpenSSL** --- Pure Rust crypto stack (`rsa`, `p256`, `p384`, `p521`, `ed25519-dalek`, `sha2`, `aes-gcm`; `ml-dsa` only with `--features pq-experimental`). TLS via `rustls` with `aws-lc-rs` backend.
 - **OpenSSL banned** --- `cargo-deny` blocks `openssl`, `openssl-sys`, and `native-tls` crate usage.
 - **Key zeroization** --- Private keys wrapped in `Zeroizing<>` for secure memory cleanup.
 - **Audit trail** --- Every sign/verify operation logged with request ID, file hash, signer, client IP, timestamp status, and duration.
@@ -536,9 +557,9 @@ The project is stable for Authenticode, detached CMS, and RFC 3161 signing workl
 
 ### v0.6 --- PQ-experimental opt-in + structural clean-up
 
-- **Feature-gate ML-DSA behind `pq-experimental`** ([#72](https://github.com/rayketcham-lab/PKI-Signing-Service/issues/72)) --- default builds drop the `ml-dsa` / `slh-dsa` dependencies entirely. Operators who want PQC opt in explicitly with `cargo build --features pq-experimental`.
+- **Feature-gate ML-DSA behind `pq-experimental`** ([#72](https://github.com/rayketcham-lab/PKI-Signing-Service/issues/72)) --- ✅ **shipped** in the current `main`. Default builds drop the `ml-dsa` / `slh-dsa` dependencies entirely; post-quantum opt-in via `cargo build --features pq-experimental`. The `default_build_cargo_tree_omits_ml_dsa` test pins the invariant.
 - **Decompose `signer.rs` / `verifier.rs` monoliths** ([#55](https://github.com/rayketcham-lab/PKI-Signing-Service/issues/55)) --- extract PFX loading and cert-validation helpers into dedicated modules without public-API churn.
-- **ML-DSA timing-side-channel tracking** ([#42](https://github.com/rayketcham-lab/PKI-Signing-Service/issues/42)) --- follow the upstream `ml-dsa` 0.0.4 → stable release and drop the `cargo-audit` ignores as soon as a constant-time Decompose lands.
+- **ML-DSA timing-side-channel tracking** ([#42](https://github.com/rayketcham-lab/PKI-Signing-Service/issues/42)) --- follow the upstream `ml-dsa` 0.0.4 → stable release and drop the `pq-experimental`-only `cargo-audit` ignores as soon as a constant-time Decompose lands.
 
 ### v0.7 --- Hybrid / composite certificates
 

crates/pki-sign/Cargo.toml

@@ -52,7 +52,7 @@ p256 = { version = "0.13", features = ["ecdsa", "pem", "ecdh"] }
 p384 = { version = "0.13", features = ["ecdsa", "pem", "ecdh"] }
 p521 = { version = "0.13", features = ["ecdsa", "pem", "ecdh"] }
 ed25519-dalek = { version = "2", features = ["pkcs8"] }
-ml-dsa = { version = "0.0.4", features = ["pkcs8"] }
+ml-dsa = { version = "0.0.4", features = ["pkcs8"], optional = true }
 signature = "2"
 pkcs8 = { version = "0.10", features = ["pem"] }
 hkdf = "0.12"
@@ -106,6 +106,13 @@ http-body-util = "0.1"
 
 [features]
 default = []
+# Experimental post-quantum signing (ML-DSA / SLH-DSA).
+#
+# Default-off because the ml-dsa 0.0.4 crate is pre-1.0 and carries open
+# timing-side-channel / implementation advisories (RUSTSEC-2025-0144,
+# CVE-2026-22705, CVE-2026-24850, GHSA-h37v-hp6w-2pp8). Gating the surface
+# keeps those CVEs out of the default build's dep graph entirely.
+pq-experimental = ["dep:ml-dsa"]
 
 [dev-dependencies]
 tempfile = { workspace = true }

crates/pki-sign/src/pkcs7/builder.rs

@@ -111,16 +111,22 @@ pub enum SigningAlgorithm {
     /// Ed25519 (RFC 8410/8419 — pure EdDSA, no separate digest).
     Ed25519,
     /// ML-DSA-44 (FIPS 204, RFC 9882 — pure scheme, SHA-256 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     MlDsa44,
     /// ML-DSA-65 (FIPS 204, RFC 9882 — pure scheme, SHA-512 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     MlDsa65,
     /// ML-DSA-87 (FIPS 204, RFC 9882 — pure scheme, SHA-512 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     MlDsa87,
     /// SLH-DSA-SHA2-128s (FIPS 205, RFC 9909 — pure scheme, SHA-256 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     SlhDsaSha2128s,
     /// SLH-DSA-SHA2-192s (FIPS 205, RFC 9909 — pure scheme, SHA-512 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     SlhDsaSha2192s,
     /// SLH-DSA-SHA2-256s (FIPS 205, RFC 9909 — pure scheme, SHA-512 for CMS digest).
+    #[cfg(feature = "pq-experimental")]
     SlhDsaSha2256s,
 }
 
@@ -138,11 +144,17 @@ impl SigningAlgorithm {
             SigningAlgorithm::EcdsaSha384 => &asn1::ECDSA_WITH_SHA384_ALGORITHM_ID,
             SigningAlgorithm::EcdsaSha512 => &asn1::ECDSA_WITH_SHA512_ALGORITHM_ID,
             SigningAlgorithm::Ed25519 => &asn1::ED25519_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::MlDsa44 => &asn1::ML_DSA_44_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::MlDsa65 => &asn1::ML_DSA_65_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::MlDsa87 => &asn1::ML_DSA_87_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::SlhDsaSha2128s => &asn1::SLH_DSA_SHA2_128S_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::SlhDsaSha2192s => &asn1::SLH_DSA_SHA2_192S_ALGORITHM_ID,
+            #[cfg(feature = "pq-experimental")]
             SigningAlgorithm::SlhDsaSha2256s => &asn1::SLH_DSA_SHA2_256S_ALGORITHM_ID,
         }
     }
@@ -156,17 +168,18 @@ impl SigningAlgorithm {
         match self {
             SigningAlgorithm::RsaSha256
             | SigningAlgorithm::RsaPssSha256
-            | SigningAlgorithm::EcdsaSha256
-            | SigningAlgorithm::MlDsa44
-            | SigningAlgorithm::SlhDsaSha2128s => DigestAlgorithm::Sha256,
+            | SigningAlgorithm::EcdsaSha256 => DigestAlgorithm::Sha256,
             SigningAlgorithm::RsaSha384
             | SigningAlgorithm::RsaPssSha384
             | SigningAlgorithm::EcdsaSha384 => DigestAlgorithm::Sha384,
             SigningAlgorithm::RsaSha512
             | SigningAlgorithm::RsaPssSha512
             | SigningAlgorithm::EcdsaSha512
-            | SigningAlgorithm::Ed25519
-            | SigningAlgorithm::MlDsa65
+            | SigningAlgorithm::Ed25519 => DigestAlgorithm::Sha512,
+            #[cfg(feature = "pq-experimental")]
+            SigningAlgorithm::MlDsa44 | SigningAlgorithm::SlhDsaSha2128s => DigestAlgorithm::Sha256,
+            #[cfg(feature = "pq-experimental")]
+            SigningAlgorithm::MlDsa65
             | SigningAlgorithm::MlDsa87
             | SigningAlgorithm::SlhDsaSha2192s
             | SigningAlgorithm::SlhDsaSha2256s => DigestAlgorithm::Sha512,
@@ -2822,7 +2835,9 @@ mod tests {
     }
 
     // ─── PQC Signing Algorithm Tests (RFC 9882 / RFC 9909) ───
+    // Gated behind `pq-experimental` — default builds don't expose these variants.
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_ml_dsa_44() {
         let alg = SigningAlgorithm::MlDsa44;
@@ -2833,6 +2848,7 @@ mod tests {
         assert_eq!(id[12], 0x11); // ML-DSA-44 OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_ml_dsa_65() {
         let alg = SigningAlgorithm::MlDsa65;
@@ -2841,6 +2857,7 @@ mod tests {
         assert_eq!(id[12], 0x12); // ML-DSA-65 OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_ml_dsa_87() {
         let alg = SigningAlgorithm::MlDsa87;
@@ -2849,6 +2866,7 @@ mod tests {
         assert_eq!(id[12], 0x13); // ML-DSA-87 OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_slh_dsa_128s() {
         let alg = SigningAlgorithm::SlhDsaSha2128s;
@@ -2857,6 +2875,7 @@ mod tests {
         assert_eq!(id[12], 0x14); // SLH-DSA-SHA2-128s OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_slh_dsa_192s() {
         let alg = SigningAlgorithm::SlhDsaSha2192s;
@@ -2865,6 +2884,7 @@ mod tests {
         assert_eq!(id[12], 0x16); // SLH-DSA-SHA2-192s OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signing_algorithm_slh_dsa_256s() {
         let alg = SigningAlgorithm::SlhDsaSha2256s;
@@ -2873,6 +2893,7 @@ mod tests {
         assert_eq!(id[12], 0x18); // SLH-DSA-SHA2-256s OID last byte
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_signed_data_builder_ml_dsa_44_signer() {
         let cert = build_test_cert(100, "PQC-Signer");
@@ -2903,6 +2924,7 @@ mod tests {
         );
     }
 
+    #[cfg(feature = "pq-experimental")]
     #[test]
     fn test_cms_alg_protection_ml_dsa_87() {
         let attr = build_cms_algorithm_protection_attr_ex(