Replace EverCBOR with TAV CBOR

[Max (maxtropets)]

✅ Long test passed

[Copilot]

🟡 Changes recommended

The migration increases the nesting limit for attacker-controlled CBOR and contains an accidental self-include.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Replaces CCF’s direct EverCBOR integration with TAV’s Rust-backed CBOR API across COSE, receipts, endorsements, and authentication.

Changes:

• Adds TAV FFI and updates Rust dependencies and lockfiles.
• Migrates CBOR parsing, serialization, helpers, and tests.
• Removes the previous C/C++ EverCBOR implementation and build integration.

Custom instructions used

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

File summaries

File	Description
src/rust/src/lib.rs	Re-exports TAV FFI.
src/rust/Cargo.toml	Adds TAV FFI dependency.
src/rust/Cargo.lock	Locks new dependency graph.
src/node/uvm_endorsements.cpp	Migrates endorsement decoding.
src/node/test/historical_queries.cpp	Migrates proof test decoding.
src/node/test/endorsements.cpp	Migrates endorsement mutation test.
src/node/quote.cpp	Migrates statement and receipt parsing.
src/node/historical_queries_adapter.cpp	Migrates proof encoding.
src/node/cose_common.h	Migrates shared COSE decoding.
src/endpoints/authentication/cose_auth.cpp	Migrates authentication parsing.
src/crypto/test/crypto.cpp	Updates CBOR test includes.
src/crypto/test/cose.cpp	Migrates COSE tests and editing.
src/crypto/test/cose_bench.cpp	Migrates benchmark decomposition.
src/crypto/test/cbor_printer.h	Adds TAV CBOR test printer.
src/crypto/test/cbor_fuzz.cpp	Migrates CBOR fuzzing.
src/crypto/openssl/cose_verifier.cpp	Migrates verifier parsing.
src/crypto/cose.cpp	Migrates unprotected-header editing.
src/crypto/cose_utils.h	Migrates x5chain parsing.
src/crypto/cbor.h	Removes legacy CBOR interface.
src/crypto/cbor.cpp	Removes legacy implementation.
src/crypto/cbor_tags.h	Preserves shared CBOR tags.
src/crypto/cbor_helpers.h	Adds immutable editing helpers.
src/cose/test/cose_ffi_test.cpp	Migrates FFI tests.
src/cose/cose_rs/src/lib.rs	Uses borrowed TAV CBOR values.
src/cose/cose_rs/Cargo.lock	Locks TAV CBOR dependency.
CMakeLists.txt	Integrates TAV and removes EverCBOR.
cmake/evercbor.cmake	Removes EverCBOR target.
cmake/crypto.cmake	Removes legacy source and linkage.
cgmanifest.json	Removes direct EverParse registration.
3rdparty/internal/evercbor/krmllib.h	Removes vendored support header.
3rdparty/internal/evercbor/internal/CBORNondet.h	Removes internal generated header.
3rdparty/internal/evercbor/CBORNondetType.h	Removes generated CBOR types.
3rdparty/internal/evercbor/CBORNondet.h	Removes generated CBOR API.
3rdparty/internal/cose-openssl/src/lib.rs	Removes private CBOR module.
3rdparty/internal/cose-openssl/src/cose.rs	Uses TAV deterministic CBOR.
3rdparty/internal/cose-openssl/src/cbor.rs	Removes duplicate CBOR wrapper.
3rdparty/internal/cose-openssl/Cargo.toml	Adds TAV CBOR dependency.

Review details

• Files reviewed: 36/39 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.