fix(kms): report ValidationException for wrong-length DIGEST in Sign

[tyrchen]

Summary

Fixes #57: Sign and Verify requests using ECC_SECG_P256K1, ECDSA_SHA_256, and a wrong-length DIGEST now return HTTP 400 ValidationException with the required digest length, instead of incorrectly reporting InvalidArnException for a valid key identifier.

Changes

• Register ValidationException in the KMS codegen configuration and map KmsError::validation to it. Regenerating into a temporary directory confirms the default variant, wire name, HTTP status, and validation helper are preserved.
• Consolidate digest regressions across Sign and Verify: empty, five-byte issue reproducer, 31-, 33-, 64-, and 4096-byte inputs. Verify tests check that digest validation takes precedence over valid and malformed signatures; existing RAW/DIGEST interoperability tests continue to pass.
• Exercise JSON deserialization, key resolution, provider dispatch, and HTTP error serialization for both valid key IDs and ARNs.
• Repair CI under Rust 1.99.0: replace deprecated atomic fetch_update with the equivalent try_update, pin the toolchain and align the Docker builder with it, and update existing empty-value test assertions for the new Clippy lint without suppressing it. Patch the locked rustls version to 0.23.45 so the dependency security checks pass.

Validation

On the final branch (CI: 30 checks passed; 4 optional compatibility jobs skipped):

• cargo build --locked
• cargo test --all-features --locked: 121 suites, 1705 passed, 0 failed, 399 ignored (server-dependent tests and ignored documentation examples)
• cargo clippy --keep-going --all-targets --all-features -- -D warnings (workspace pedantic lints and established exceptions)
• Additional isolated-target cargo clippy -p rustack-auth --all-targets -- -D warnings
• cargo +nightly fmt -- --check, stable cargo fmt --all -- --check, and git diff --check
• cargo audit and cargo deny check
• KMS codegen regeneration into a temporary directory
• Docker builder rust:1.99.0-slim tag verified in the official registry for amd64 and arm64; Docker build/health checks run in CI

The KMS production change only corrects the error mapping; it adds no work to successful signing or verification. Algorithm support and other explicit uses of InvalidArnException remain outside this fix.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T18:27:55.333820Z	7f8537e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d0d827c537

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".