From bf6d5c67f741de15e65ec900e0b3a8ee6ac7e8e7 Mon Sep 17 00:00:00 2001
From: mmorrissette-devolutions <mmorrissette@devolutions.net>
Date: Mon, 10 Aug 2026 11:41:14 -0400
Subject: [PATCH 1/2] ci: restrict GITHUB_TOKEN permissions to contents: read

---
 .github/workflows/ci.yml            | 3 +++
 .github/workflows/fuzz-extended.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f420e10e..b33b2224 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 env:
   XCODE_VERSION: 26.5
 
diff --git a/.github/workflows/fuzz-extended.yml b/.github/workflows/fuzz-extended.yml
index 496bd7da..1ba60c6f 100644
--- a/.github/workflows/fuzz-extended.yml
+++ b/.github/workflows/fuzz-extended.yml
@@ -12,6 +12,9 @@ on:
         default: '480'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   extended_fuzz:
     runs-on: ubuntu-22.04

From 1511c039e401021e159011342ce63d4511ad097b Mon Sep 17 00:00:00 2001
From: mmorrissette-devolutions <mmorrissette@devolutions.net>
Date: Mon, 10 Aug 2026 11:53:43 -0400
Subject: [PATCH 2/2] fix(cli): remove redundant references in println!
 arguments

Clippy 1.97 promotes useless_borrows_in_formatting, which the CI
formatting job treats as an error via -D warnings.
---
 cli/src/main.rs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/cli/src/main.rs b/cli/src/main.rs
index 06e97161..4d8c9d6b 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -569,7 +569,7 @@ fn print_header(data: String) {
                 devolutions_crypto::ciphertext::Ciphertext,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -579,7 +579,7 @@ fn print_header(data: String) {
                 devolutions_crypto::password_hash::PasswordHash,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -589,7 +589,7 @@ fn print_header(data: String) {
                 devolutions_crypto::secret_sharing::Share,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -600,13 +600,13 @@ fn print_header(data: String) {
                     &data[0..8],
                 )
             {
-                println!("{:?}", &h);
+                println!("{:?}", h);
             } else if let Ok(h) =
                 devolutions_crypto::Header::<devolutions_crypto::key::PrivateKey>::try_from(
                     &data[0..8],
                 )
             {
-                println!("{:?}", &h);
+                println!("{:?}", h);
             } else {
                 println!("Invalid Header");
             }
@@ -616,7 +616,7 @@ fn print_header(data: String) {
                 devolutions_crypto::derive_encrypt::KdfEncryptedData,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }