Migration from v0.5

/// The reference compatibility record is a configured codec for the common/// Query and Heartbeat subset, rather than implicit version fallback.#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]pub struct LegacyCore {    pub version: u64,    pub deployment: u64,    pub source: u64,    pub target: u64,    pub principal: u64,    pub key: u64,    pub epoch: u64,    pub sent: u64,    pub ttl: u64,    pub uuid: String,    pub family: u64,    pub opcode: u64,    pub words: Vec<u64>,    pub atomicity: u64,    pub scope: u64,}#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]pub struct LegacyPacket {    pub core: LegacyCore,    pub signature: String,}impl LegacyPacket {    pub fn encode(&self) -> Result<Vec<u8>> {        serde_json::to_vec(self).map_err(|_| BAD)    }}impl LegacyCore {    pub fn signing_bytes(&self) -> Result<Vec<u8>> {        let mut bytes = b"OIP\0LEGACY\0".to_vec();        bytes.extend(serde_json::to_vec(self).map_err(|_| BAD)?);        Ok(bytes)    }

type LegacyCore struct {	Version    uint64   `json:"version"`	Deployment uint64   `json:"deployment"`	Source     uint64   `json:"source"`	Target     uint64   `json:"target"`	Principal  uint64   `json:"principal"`	Key        uint64   `json:"key"`	Epoch      uint64   `json:"epoch"`	Sent       uint64   `json:"sent"`	TTL        uint64   `json:"ttl"`	UUID       string   `json:"uuid"`	Family     uint64   `json:"family"`	Opcode     uint64   `json:"opcode"`	Words      []uint64 `json:"words"`	Atomicity  uint64   `json:"atomicity"`	Scope      uint64   `json:"scope"`}type LegacyPacket struct {	Core      LegacyCore `json:"core"`	Signature string     `json:"signature"`}func (core LegacyCore) SigningBytes() ([]byte, error) {	body, err := json.Marshal(core)	if err != nil {		return nil, ErrFormat	}	return append([]byte("OIP\x00LEGACY\x00"), body...), nil}

pub fn receive(bytes: &[u8], profile: &Profile, boundary: &Boundary) -> Result<ValidatedLegacy> {    if profile.version != 5 {        return Err(WireError::UnsupportedVersion);    }    if bytes.len() > boundary.max_frame {        return Err(BAD);    }    let packet: LegacyPacket = serde_json::from_slice(bytes).map_err(|_| BAD)?;    if packet.encode()? != bytes {        return Err(BAD);    }    let core = packet.core.typed()?;    check_versioned_scope(&core, profile, boundary, 5)?;    if !profile.schemes.contains(&1)        || !verify(            &boundary.public_key,            &packet.core.signing_bytes()?,            &unhex(&packet.signature)?,        )    {        return Err(WireError::InvalidSignature);    }    super::operands::decode(&core, boundary.max_nesting)?;    Ok(ValidatedLegacy {        core,        exact: serde_json::to_vec(&packet.core).map_err(|_| BAD)?,    })}

func DecodeLegacy(raw []byte, profile Profile, boundary Boundary) (*wirepb.Core, []byte, error) {	if profile.Version != 5 {		return nil, nil, ErrVersion	}	if len(raw) > boundary.MaxFrame {		return nil, nil, ErrFormat	}	var packet LegacyPacket	if !canonicalJSON(raw, &packet) {		return nil, nil, ErrFormat	}	core, err := packet.Core.typed()	if err != nil {		return nil, nil, err	}	if err := checkScope(core, profile, boundary, 5); err != nil {		return nil, nil, err	}	// The scheme check comes first, then the signature encoding, then the	// signature itself, as in the reference decoder.	if !slices.Contains(profile.Schemes, uint64(1)) {		return nil, nil, ErrSignature	}	preimage, err := packet.Core.SigningBytes()	if err != nil {		return nil, nil, ErrFormat	}	signature, err := hex.DecodeString(packet.Signature)	if err != nil || hex.EncodeToString(signature) != packet.Signature {		return nil, nil, ErrFormat	}	if !verify(boundary.PublicKey, preimage, signature) {		return nil, nil, ErrSignature	}	if _, err := DecodeOperands(core, boundary.MaxNesting); err != nil {		return nil, nil, err	}	exact, err := json.Marshal(packet.Core)	if err != nil {		return nil, nil, ErrFormat	}	return core, exact, nil}

/// The version check that runs in front of the canonical decoder and the/// admission gate. A frame within the size limit that declares a version/// other than 6 receives UnsupportedVersion, whatever fields follow. Every/// other frame continues to the canonical checks unchanged.pub fn check_declared_version(bytes: &[u8], max_frame: usize) -> Result<()> {    if bytes.len() > max_frame {        return Err(BAD);    }    match declared_version(bytes) {        Some(version) if version != 6 => Err(WireError::UnsupportedVersion),        _ => Ok(()),    }}

// CheckDeclaredVersion is the version check that runs in front of the// canonical decoder and the admission gate. A frame within the size limit// that declares a version other than 6 receives ErrVersion, whatever fields// follow. Every other frame continues to the canonical checks unchanged.func CheckDeclaredVersion(raw []byte, maxFrame int) error {	if maxFrame < 0 || len(raw) > maxFrame {		return ErrFormat	}	if version, ok := DeclaredVersion(raw); ok && version != 6 {		return ErrVersion	}	return nil}

pub fn select_profile(    local: &Offer,    remote: &Offer,    floor: u64,    legacy_allowed: bool,) -> Result<Profile> {    let version = [6, 5]        .into_iter()        .find(|&version| {            version >= floor                && (version != 5 || legacy_allowed)                && local.versions.contains(&version)                && remote.versions.contains(&version)        })        .ok_or(WireError::UnsupportedVersion)?;    Ok(Profile {        version,        families: local            .families            .intersection(&remote.families)            .copied()            .filter(|family| version != 5 || matches!(family, 4 | 6))            .collect(),        atomicities: local            .atomicities            .intersection(&remote.atomicities)            .copied()            .collect(),        schemes: local            .schemes            .intersection(&remote.schemes)            .copied()            .filter(|scheme| version != 5 || *scheme == 1)            .collect(),    })}

func SelectProfile(local, remote Offer, floor uint64, legacyAllowed bool) (Profile, error) {	for _, s := range [][]uint64{local.Versions, local.Families, local.Atomicities, local.Schemes,		remote.Versions, remote.Families, remote.Atomicities, remote.Schemes} {		if !strictlySorted(s) {			return Profile{}, ErrFormat		}	}	for _, v := range []uint64{6, 5} {		if v >= floor && (v != 5 || legacyAllowed) && slices.Contains(local.Versions, v) && slices.Contains(remote.Versions, v) {			families := intersect(local.Families, remote.Families)			schemes := intersect(local.Schemes, remote.Schemes)			if v == 5 {				families = intersect(families, []uint64{4, 6})				schemes = intersect(schemes, []uint64{1})			}			return Profile{Version: v, Families: families, Atomicities: intersect(local.Atomicities, remote.Atomicities), Schemes: schemes}, nil		}	}	return Profile{}, ErrVersion}

let input = match channel.profile().version {    6 => {        check_declared_version(bytes, frame_limit)?;        Input::Modern(Box::new(decode_packet(bytes, frame_limit)?))    }    5 if product.security.legacy_configured(channel) => Input::Legacy {        bytes,        core: Box::new(legacy::decode_shape(bytes, frame_limit)?),    },    _ => return Err(WireError::UnsupportedVersion),};

// ReceiveVersioned uses the negotiated codec once. A modern failure cannot// enter the configured legacy adapter.func (store *TransportBindings) ReceiveVersioned(raw []byte, channel Channel, boundary Boundary,	legacyConfigured bool, attest func(*wirepb.Core) bool) (Arrival, *wirepb.Core, error) {	if channel.deployment != boundary.Deployment || channel.local != boundary.Target ||		channel.remote != boundary.Source || channel.expires < boundary.Now {		return First, nil, ErrSource	}	switch channel.profile.Version {	case 6:		arrival, packet, err := store.Receive(raw, channel.profile, boundary, attest)		if err != nil {			return First, nil, err		}		return arrival, packet.Core(), nil	case 5:		if !legacyConfigured {			return First, nil, ErrVersion		}		// DecodeLegacy has already decoded the operands of the admitted Core.		core, exact, err := DecodeLegacy(raw, channel.profile, boundary)		if err != nil {			return First, nil, err		}		// Keep attestation mutations separate from the admitted Core and key.		if !attest(proto.Clone(core).(*wirepb.Core)) {			return First, nil, ErrSource		}		key, err := Key(core)		if err != nil {			return First, nil, err		}		arrival, err := store.bind(key, exact)		if err != nil {			return First, nil, err		}		return arrival, core, nil	default:		return First, nil, ErrVersion	}}

#[derive(Clone, PartialEq, ::prost::Message)]pub struct Operation {    #[prost(uint64, optional, tag = "1")]    pub opcode: Option<u64>,    #[prost(fixed64, repeated, packed = "false", tag = "2")]    pub words: Vec<u64>,    #[prost(bytes = "vec", repeated, tag = "3")]    pub blobs: Vec<Vec<u8>>,    #[prost(oneof = "operation::AppealDeadline", tags = "4, 5")]    pub appeal_deadline: Option<operation::AppealDeadline>,}pub mod operation {    #[derive(Clone, PartialEq, ::prost::Oneof)]    pub enum AppealDeadline {        #[prost(bool, tag = "4")]        AppealDeadlineIndefinite(bool),        #[prost(fixed64, tag = "5")]        AppealDeadlineUtcSeconds(u64),    }}

type isOperation_AppealDeadline interface {	isOperation_AppealDeadline()}type Operation_AppealDeadlineIndefinite struct {	// Only the value true is canonical.	AppealDeadlineIndefinite bool `protobuf:"varint,4,opt,name=appeal_deadline_indefinite,json=appealDeadlineIndefinite,oneof"`}type Operation_AppealDeadlineUtcSeconds struct {	// Unix time in UTC seconds.	AppealDeadlineUtcSeconds uint64 `protobuf:"fixed64,5,opt,name=appeal_deadline_utc_seconds,json=appealDeadlineUtcSeconds,oneof"`}func (*Operation_AppealDeadlineIndefinite) isOperation_AppealDeadline() {}func (*Operation_AppealDeadlineUtcSeconds) isOperation_AppealDeadline() {}