project-oak · daviddrysdale · Nov 24, 2025 · Nov 24, 2025 · Nov 24, 2025 · Nov 24, 2025
diff --git a/aead/src/lib.rs b/aead/src/lib.rs
@@ -19,7 +19,7 @@
 //! AEAD encryption assures the confidentiality and authenticity of the data. This primitive is CPA
 //! secure.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 use tink_core::registry::register_key_manager;

diff --git a/aead/src/subtle/aes_ctr.rs b/aead/src/subtle/aes_ctr.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-//! AES-CTR implementation of [`IndCpaCipher`](super::IndCpaCipher).
+//! AES-CTR implementation of [`IndCpaCipher`].
 
 use super::IndCpaCipher;
 use aes::cipher::{consts::U16, generic_array::GenericArray, KeyIvInit, StreamCipher};

diff --git a/core/src/lib.rs b/core/src/lib.rs
@@ -17,7 +17,7 @@
 //! Core crate for Tink.
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 pub mod cryptofmt;
 pub mod keyset;

diff --git a/daead/src/key_templates.rs b/daead/src/key_templates.rs
@@ -18,7 +18,7 @@
 
 use tink_proto::{prost::Message, KeyTemplate};
 
-/// Return a [`KeyTemplate`](tink_proto::KeyTemplate) that generates a AES-SIV key.
+/// Return a [`KeyTemplate`] that generates a AES-SIV key.
 pub fn aes_siv_key_template() -> KeyTemplate {
     let format = tink_proto::AesSivKeyFormat {
         key_size: 64,

diff --git a/daead/src/lib.rs b/daead/src/lib.rs
@@ -19,7 +19,7 @@
 //! Unlike AEAD, implementations of this interface are not semantically secure, because
 //! encrypting the same plaintex always yields the same ciphertext.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 

diff --git a/hybrid/src/lib.rs b/hybrid/src/lib.rs
@@ -28,7 +28,7 @@
 //! the secrecy or authenticity of `context_info`).
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 use tink_core::registry::{register_key_manager, register_template_generator};

diff --git a/mac/src/lib.rs b/mac/src/lib.rs
@@ -20,7 +20,7 @@
 //! message.  MAC protects data integrity as well as provides for authenticity
 //! of the message.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 

diff --git a/prf/src/lib.rs b/prf/src/lib.rs
@@ -16,7 +16,7 @@
 
 //! This crate provides implementations of the [`tink_core::Prf`] primitive.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 use tink_core::registry::register_key_manager;

diff --git a/proto/proto/kms_aead.proto b/proto/proto/kms_aead.proto
@@ -26,9 +26,9 @@ message KmsAeadKeyFormat {
   // Required.
   // The location of a KMS key.
   // With Google Cloud KMS, valid values have this format:
-  // gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+  // `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
   // With AWS KMS, valid values have this format:
-  // aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+  // `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
   string key_uri = 1;
 }
 

diff --git a/proto/proto/kms_envelope.proto b/proto/proto/kms_envelope.proto
@@ -28,9 +28,9 @@ message KmsEnvelopeAeadKeyFormat {
   // Required.
   // The location of the KEK in a remote KMS.
   // With Google Cloud KMS, valid values have this format:
-  // gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+  // `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
   // With AWS KMS, valid values have this format:
-  // aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+  // `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
   string kek_uri = 1;
   // Key template of the Data Encryption Key, e.g., AesCtrHmacAeadKeyFormat.
   // Required.

diff --git a/proto/src/codegen/google.crypto.tink.rs b/proto/src/codegen/google.crypto.tink.rs
@@ -964,9 +964,9 @@ pub struct KmsAeadKeyFormat {
     /// Required.
     /// The location of a KMS key.
     /// With Google Cloud KMS, valid values have this format:
-    /// gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+    /// `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
     /// With AWS KMS, valid values have this format:
-    /// aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+    /// `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
     #[prost(string, tag = "1")]
     pub key_uri: ::prost::alloc::string::String,
 }
@@ -984,9 +984,9 @@ pub struct KmsEnvelopeAeadKeyFormat {
     /// Required.
     /// The location of the KEK in a remote KMS.
     /// With Google Cloud KMS, valid values have this format:
-    /// gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+    /// `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
     /// With AWS KMS, valid values have this format:
-    /// aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+    /// `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
     #[prost(string, tag = "1")]
     pub kek_uri: ::prost::alloc::string::String,
     /// Key template of the Data Encryption Key, e.g., AesCtrHmacAeadKeyFormat.

diff --git a/proto/src/codegen/serde/google.crypto.tink.rs b/proto/src/codegen/serde/google.crypto.tink.rs
@@ -983,9 +983,9 @@ pub struct KmsAeadKeyFormat {
     /// Required.
     /// The location of a KMS key.
     /// With Google Cloud KMS, valid values have this format:
-    /// gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+    /// `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
     /// With AWS KMS, valid values have this format:
-    /// aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+    /// `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
     #[prost(string, tag = "1")]
     pub key_uri: ::prost::alloc::string::String,
 }
@@ -1003,9 +1003,9 @@ pub struct KmsEnvelopeAeadKeyFormat {
     /// Required.
     /// The location of the KEK in a remote KMS.
     /// With Google Cloud KMS, valid values have this format:
-    /// gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*.
+    /// `gcp-kms://projects/*/locations/*/keyRings/*/cryptoKeys/*`.
     /// With AWS KMS, valid values have this format:
-    /// aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>
+    /// `aws-kms://arn:aws:kms:<region>:<account-id>:key/<key-id>`
     #[prost(string, tag = "1")]
     pub kek_uri: ::prost::alloc::string::String,
     /// Key template of the Data Encryption Key, e.g., AesCtrHmacAeadKeyFormat.

diff --git a/proto/src/lib.rs b/proto/src/lib.rs
@@ -21,7 +21,7 @@
 //! the upstream [Tink project](https://github.com/google/tink/tree/master/proto).
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 #![allow(clippy::derive_partial_eq_without_eq)]
 #![allow(clippy::too_long_first_doc_paragraph)]
 

diff --git a/signature/src/lib.rs b/signature/src/lib.rs
@@ -18,7 +18,7 @@
 //!
 //! To sign data using Tink you can use ECDSA or ED25519 key templates.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 use tink_core::registry::{register_key_manager, register_template_generator};

diff --git a/signature/src/proto.rs b/signature/src/proto.rs
@@ -19,8 +19,7 @@
 use std::convert::TryFrom;
 use tink_proto::{EcdsaParams, EcdsaSignatureEncoding, EllipticCurveType, HashType};
 
-/// Return the enum values of each parameter in
-/// the given [`EcdsaParams`](tink_proto::EcdsaParams).
+/// Return the enum values of each parameter in the given [`EcdsaParams`].
 pub(crate) fn get_ecdsa_param_ids(
     params: &EcdsaParams,
 ) -> (HashType, EllipticCurveType, EcdsaSignatureEncoding) {

diff --git a/streaming/src/lib.rs b/streaming/src/lib.rs
@@ -19,7 +19,7 @@
 //! AEAD encryption assures the confidentiality and authenticity of the data.
 //! This primitive is CPA secure.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use std::sync::Once;
 use tink_core::registry::register_key_manager;

diff --git a/streaming/src/subtle/aes_ctr_hmac.rs b/streaming/src/subtle/aes_ctr_hmac.rs
@@ -128,7 +128,7 @@ impl AesCtrHmac {
 }
 
 impl tink_core::StreamingAead for AesCtrHmac {
-    /// Return a wrapper around an underlying [`std::io.Write`], such that
+    /// Return a wrapper around an underlying [`std::io::Write`], such that
     /// any write-operation via the wrapper results in AEAD-encryption of the
     /// written data, using `aad` as associated authenticated data. The associated
     /// data is not included in the ciphertext and has to be passed in as parameter

diff --git a/tests/src/lib.rs b/tests/src/lib.rs
@@ -16,7 +16,7 @@
 
 //! Provides common methods needed in test code.
 
-#![deny(broken_intra_doc_links)]
+#![deny(rustdoc::broken_intra_doc_links)]
 
 use generic_array::typenum::Unsigned;
 use p256::elliptic_curve;