Canonicalization profile v1 across all bindings

.devcontainer/devcontainer.json

@@ -6,14 +6,21 @@
       "version": "22"
     },
     "ghcr.io/devcontainers/features/go:1": {
-      "version": "1.23"
+      "version": "1.25"
     },
     "ghcr.io/devcontainers/features/php:1": {
-      "version": "8.3",
+      "version": "8.5",
       "installComposer": true
+    },
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "3.12"
+    },
+    "ghcr.io/devcontainers/features/rust:1": {
+      "version": "1.86",
+      "profile": "minimal"
     }
   },
-  "postCreateCommand": "cd go && go mod tidy && cd ../php && composer install --no-interaction",
+  "postCreateCommand": "bash .devcontainer/setup.sh",
   "customizations": {
     "vscode": {
       "extensions": [

.devcontainer/setup.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install every dependency needed by the checked-in tests. Keep this script
+# safe to rerun when a container is rebuilt or a dependency changes.
+npm ci --ignore-scripts --no-audit --no-fund
+python3 -m pip install --disable-pip-version-check -e 'python[dev]'
+(cd php && composer install --no-interaction --prefer-dist)
+(cd go && go mod download)
+cargo fetch --locked --manifest-path rust/Cargo.toml
+cargo fetch --locked --manifest-path ffi/Cargo.toml
+cargo fetch --locked --manifest-path conformance/runners/run-rust/Cargo.toml

.docker/php/Dockerfile

@@ -0,0 +1,8 @@
+FROM php:8.5-cli
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends git libicu-dev unzip \
+    && docker-php-ext-install intl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer

.github/workflows/ci.yml

@@ -23,6 +23,9 @@ jobs:
         with:
           node-version: "22"
 
+      - name: Install JavaScript dependencies
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
       - name: Run tests
         working-directory: javascript
         run: node test.js
@@ -111,8 +114,8 @@ jobs:
 
       - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 # v2
         with:
-          php-version: "8.3"
-          extensions: intl, mbstring
+          php-version: "8.5"
+          extensions: dom, intl, mbstring
 
       - name: Install dependencies
         working-directory: php
@@ -129,6 +132,45 @@ jobs:
             php/src/
             php/composer.json
 
+  python:
+    name: Python
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Python package and test dependencies
+        run: python -m pip install --disable-pip-version-check -e 'python[dev]'
+
+      - name: Run tests
+        working-directory: python
+        run: python -m pytest
+
+      - name: Verify generated signing vector
+        run: python tools/gen-test-vectors.py --check
+
+  rust:
+    name: Rust
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: "1.86"
+
+      - name: Run tests
+        run: |
+          cargo test --locked --manifest-path rust/Cargo.toml
+          cargo test --locked --manifest-path ffi/Cargo.toml
+
   conformance:
     name: Cross-language conformance
     runs-on: ubuntu-latest
@@ -141,33 +183,33 @@ jobs:
         with:
           node-version: "22"
 
+      - name: Install JavaScript dependencies
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.25"
 
       - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 # v2
         with:
-          php-version: "8.3"
-          extensions: intl, mbstring
+          php-version: "8.5"
+          extensions: dom, intl, mbstring
+
+      - name: Install PHP dependencies
+        working-directory: php
+        run: composer install --no-interaction --prefer-dist
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
-      # This action picks the toolchain from the ref name it is called by, so
-      # `@stable` used to be what selected stable Rust. Pinning to a commit
-      # removes that signal, and the toolchain must be named explicitly instead
-      # -- without the `with:` block below the step installs nothing usable.
-      #
-      # The pin is the head of the `stable` branch, which is a moving branch
-      # rather than a release tag: re-resolve it when bumping, and expect no
-      # semver tag to correspond.
-      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch
+      # Pin the action implementation and name the compiler version explicitly.
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
         with:
-          toolchain: stable
+          toolchain: "1.86"
 
-      - name: Install Python binding dependencies
-        run: python3 -m pip install beautifulsoup4
+      - name: Install Python binding and test dependencies
+        run: python3 -m pip install --disable-pip-version-check -e 'python[dev]'
 
       # REQUIRE_ALL_LANGUAGES=1 makes run-all.sh fail rather than skip when a
       # runner is missing, so every one of the five implementations is actually

.gitignore

@@ -6,16 +6,10 @@ Thumbs.db
 node_modules/
 
 # Go
-# go/go.sum is deliberately NOT ignored. It is a checksum file, not a version
-# lock -- the library-doesn't-commit-its-lockfile convention that applies to
-# php/composer.lock and rust/Cargo.lock below does not apply to it. Without a
-# committed go.sum nothing verifies that the module contents CI builds are the
-# same bytes anyone else gets, and `go mod verify` has nothing to check
-# against. Commit go/go.sum alongside go/go.mod.
+# go/go.sum is committed so CI can verify downloaded module contents.
 
 # PHP
 php/vendor/
-php/composer.lock
 
 # Python
 python/.venv/
@@ -29,11 +23,9 @@ __pycache__/
 
 # Rust
 rust/target/
-rust/Cargo.lock
 
 # Conformance suite artifacts
 conformance/runners/run-rust/target/
-conformance/runners/run-rust/Cargo.lock
 
 # IDE
 .idea/

Makefile

@@ -5,11 +5,12 @@
 # under `conformance/fixtures/`. `make conformance` exercises every
 # runnable language.
 
-.PHONY: conformance conformance-update conformance-js conformance-go \
+.PHONY: test-docker conformance conformance-update conformance-js conformance-go \
         conformance-php conformance-python conformance-rust help
 
 help:
 	@echo "Targets:"
+	@echo "  test-docker         Test all five bindings in isolated containers."
 	@echo "  conformance         Run every per-language conformance runner."
 	@echo "  conformance-update  Regenerate fixture 'expected' fields from"
 	@echo "                      the current Python+Rust output."
@@ -19,6 +20,9 @@ help:
 conformance:
 	./conformance/run-all.sh
 
+test-docker:
+	./scripts/test-in-docker.sh
+
 # Regenerate fixture expected fields. Run each available language with
 # --update; later runs overwrite earlier ones if they disagree, which
 # is what you want -- the last language to run is the source of truth.
@@ -42,5 +46,5 @@ conformance-python:
 	python3 conformance/runners/run-python.py
 
 conformance-rust:
-	cargo run --quiet --release \
+	cargo run --quiet --release --locked \
 	    --manifest-path conformance/runners/run-rust/Cargo.toml