From 79a8afc797d49f08d95789518f420097cae557d3 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Thu, 22 Aug 2024 18:26:31 +0200
Subject: [PATCH 01/12] prepare merge queues

---
 .github/workflows/c-bench.yml             |  47 +++++++++
 .github/workflows/c.yml                   |  53 ----------
 .github/workflows/checks.yml              |   1 +
 .github/workflows/ecdh.yml                |   1 +
 .github/workflows/hax.yml                 |   1 +
 .github/workflows/kem.yml                 |   1 +
 .github/workflows/mldsa.yml               |   1 +
 .github/workflows/mlkem-bench.yml         | 103 ++++++++++++++++++
 .github/workflows/mlkem.yml               |  94 -----------------
 .github/workflows/nix.yml                 |   1 +
 .github/workflows/platform.yml            |   1 +
 .github/workflows/rust-bench.yml          |  98 +++++++++++++++++
 .github/workflows/rust.yml                |  86 ---------------
 .github/workflows/skip-benches-in-prs.yml |  14 +++
 .github/workflows/specs.yml               |   1 +
 Cargo.lock                                | 122 +++++++++++++++++++---
 Cargo.toml                                |   5 +
 libcrux-ml-kem/Cargo.toml                 |   3 +
 18 files changed, 385 insertions(+), 248 deletions(-)
 create mode 100644 .github/workflows/c-bench.yml
 create mode 100644 .github/workflows/mlkem-bench.yml
 create mode 100644 .github/workflows/rust-bench.yml
 create mode 100644 .github/workflows/skip-benches-in-prs.yml

diff --git a/.github/workflows/c-bench.yml b/.github/workflows/c-bench.yml
new file mode 100644
index 000000000..a2628bf2e
--- /dev/null
+++ b/.github/workflows/c-bench.yml
@@ -0,0 +1,47 @@
+name: Benchmark C
+
+on:
+  workflow_dispatch:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: libcrux-ml-kem/c
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: 🔨 Build Release
+        run: |
+          cmake -B build -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --config Release
+
+      # FIXME: Benchmarks on Windows CI are not working right now.
+      # - name: 🏃🏻‍♀️ Benchmark
+      #   run: ./build/Release/ml_kem_bench
+      #   if: ${{ matrix.os == 'windows-latest' }}
+
+      - name: 🏃🏻‍♀️ Benchmark (c)
+        run: ./build/ml_kem_bench
+        if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
+
+      - name: 🏃🏻‍♀️ Benchmark (cg)
+        working-directory: libcrux-ml-kem/cg
+        run: ./build/ml_kem_bench
+        if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
diff --git a/.github/workflows/c.yml b/.github/workflows/c.yml
index c734bf0de..285eac24a 100644
--- a/.github/workflows/c.yml
+++ b/.github/workflows/c.yml
@@ -14,7 +14,6 @@ concurrency:
 
 jobs:
   extract:
-    if: ${{ github.event_name != 'merge_group' }}
     runs-on: ubuntu-latest
     container: franziskus/libcrux-c:latest
     defaults:
@@ -36,7 +35,6 @@ jobs:
           if-no-files-found: error
 
   extract-header-only:
-    if: ${{ github.event_name != 'merge_group' }}
     runs-on: ubuntu-latest
     container: franziskus/libcrux-c:latest
     defaults:
@@ -59,7 +57,6 @@ jobs:
 
   diff:
     needs: [extract]
-    if: ${{ github.event_name != 'merge_group' }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -80,7 +77,6 @@ jobs:
 
   diff-header-only:
     needs: [extract-header-only]
-    if: ${{ github.event_name != 'merge_group' }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -101,7 +97,6 @@ jobs:
 
   build:
     needs: [extract]
-    if: ${{ github.event_name != 'merge_group' }}
     strategy:
       fail-fast: false
       matrix:
@@ -141,7 +136,6 @@ jobs:
 
   build-header-only:
     needs: [extract-header-only]
-    if: ${{ github.event_name != 'merge_group' }}
     strategy:
       fail-fast: false
       matrix:
@@ -174,50 +168,3 @@ jobs:
       - name: 🏃🏻‍♀️ Test
         run: ./build/ml_kem_test
         if: ${{ matrix.os != 'windows-latest' }}
-
-  benchmark:
-    if: ${{ github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - macos-latest
-          - ubuntu-latest
-          - windows-latest
-
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        shell: bash
-        working-directory: libcrux-ml-kem/c
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: 🔨 Build Release
-        run: |
-          cmake -B build -DCMAKE_BUILD_TYPE=Release
-          cmake --build build --config Release
-
-      # FIXME: Benchmarks on Windows CI are not working right now.
-      # - name: 🏃🏻‍♀️ Benchmark
-      #   run: ./build/Release/ml_kem_bench
-      #   if: ${{ matrix.os == 'windows-latest' }}
-
-      - name: 🏃🏻‍♀️ Benchmark (c)
-        run: ./build/ml_kem_bench
-        if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
-
-      - name: 🏃🏻‍♀️ Benchmark (cg)
-        working-directory: libcrux-ml-kem/cg
-        run: ./build/ml_kem_bench
-        if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
-
-  mq_status:
-    if: |
-      always() &&
-      (github.event_name ==  'workflow_dispatch' || github.event_name ==  'merge_group')
-    needs: [benchmark]
-    uses: cryspen/actions/.github/workflows/merge-queue-status.yml@jonas/merge-queue-status
-    with:
-      needs_json: "${{toJSON(needs)}}"
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 5fab6fabd..0438fb798 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: ["main", "dev"]
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/ecdh.yml b/.github/workflows/ecdh.yml
index feee99cfa..438386e60 100644
--- a/.github/workflows/ecdh.yml
+++ b/.github/workflows/ecdh.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: ["main", "dev", "*"]
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/hax.yml b/.github/workflows/hax.yml
index bac3854d5..d324bff1c 100644
--- a/.github/workflows/hax.yml
+++ b/.github/workflows/hax.yml
@@ -11,6 +11,7 @@ on:
     - cron: "0 0 * * *"
 
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/kem.yml b/.github/workflows/kem.yml
index ca3c7f23f..d4ada3cdf 100644
--- a/.github/workflows/kem.yml
+++ b/.github/workflows/kem.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: ["main", "dev", "*"]
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/mldsa.yml b/.github/workflows/mldsa.yml
index 8c46feafd..a05d1e6c3 100644
--- a/.github/workflows/mldsa.yml
+++ b/.github/workflows/mldsa.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: ["main", "dev", "*"]
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/mlkem-bench.yml b/.github/workflows/mlkem-bench.yml
new file mode 100644
index 000000000..b5c825c09
--- /dev/null
+++ b/.github/workflows/mlkem-bench.yml
@@ -0,0 +1,103 @@
+name: Benchmark ML-KEM
+
+on:
+  workflow_dispatch:
+  merge_group:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    strategy:
+      fail-fast: true
+      matrix:
+        bits: [32, 64]
+        os:
+          - macos-13
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+        exclude:
+          # There's no such thing as 32-bit macOS
+          - bits: 32
+            os: "macos-latest"
+          - bits: 32
+            os: "macos-13"
+
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: libcrux-ml-kem
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update dependencies
+        run: cargo update
+
+      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
+        if: ${{ matrix.bits == 64 }}
+
+      - name: 🛠️ Setup Ubuntu x86
+        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
+        run: |
+          rustup target add i686-unknown-linux-gnu
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib g++-multilib
+
+      - name: 🛠️ Setup Ubuntu x64
+        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
+        run: |
+          rustup target add aarch64-unknown-linux-gnu
+
+      - name: 🛠️ Setup macOS
+        if: ${{  matrix.os == 'macos-latest' }}
+        run: |
+          rustup target add aarch64-apple-darwin
+
+      # Set up 32 bit systems
+
+      - name: 🛠️ Config Windows x86
+        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
+        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
+
+      - name: 🛠️ Config Linux x86
+        run: |
+          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
+        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}
+
+      # - name: 🔨 Build
+      #   run: cargo build --benches
+
+      # - name: ⬆ Upload build
+      #   uses: ./.github/actions/upload_artifacts
+      #   with:
+      #     name: benchmarks_${{ matrix.os }}_${{ matrix.bits }}
+
+      # Benchmarks ...
+
+      - name: 🏃🏻‍♀️ Benchmarks
+        run: cargo bench --verbose $RUST_TARGET_FLAG -- --output-format bencher | tee bench.txt 
+
+      - name: 🏃🏻‍♀️ Benchmarks Portable
+        run: |
+          cargo clean
+          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo bench --verbose $RUST_TARGET_FLAG -- --output-format bencher | sed 's/^test \(.*\) \.\.\. bench/test portable \1 ... bench/' | tee -a bench.txt 
+      - name: Store benchmarks
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          name: ML-KEM Benchmark
+          tool: 'cargo'
+          output-file-path: libcrux-ml-kem/bench.txt
+          benchmark-data-dir-path: dev/bench/mlkem
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          auto-push: true
+
+        
+
diff --git a/.github/workflows/mlkem.yml b/.github/workflows/mlkem.yml
index 6e7c59209..575339c5d 100644
--- a/.github/workflows/mlkem.yml
+++ b/.github/workflows/mlkem.yml
@@ -17,7 +17,6 @@ concurrency:
 
 jobs:
   build:
-    if: ${{ github.event_name != 'merge_group' }}
     strategy:
       fail-fast: false
       matrix:
@@ -174,96 +173,3 @@ jobs:
         run: |
           cargo clean
           cargo hack test --each-feature $EXCLUDE_FEATURES --verbose $RUST_TARGET_FLAG
-
-  benchmarks:
-    if: ${{ github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' }}
-    strategy:
-      fail-fast: true
-      matrix:
-        bits: [32, 64]
-        os:
-          - macos-13
-          - macos-latest
-          - ubuntu-latest
-          - windows-latest
-        exclude:
-          # There's no such thing as 32-bit macOS
-          - bits: 32
-            os: "macos-latest"
-          - bits: 32
-            os: "macos-13"
-
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        shell: bash
-        working-directory: libcrux-ml-kem
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Update dependencies
-        run: cargo update
-
-      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
-        if: ${{ matrix.bits == 64 }}
-
-      - name: 🛠️ Setup Ubuntu x86
-        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
-        run: |
-          rustup target add i686-unknown-linux-gnu
-          sudo apt-get update
-          sudo apt-get install -y gcc-multilib g++-multilib
-
-      - name: 🛠️ Setup Ubuntu x64
-        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
-        run: |
-          rustup target add aarch64-unknown-linux-gnu
-
-      - name: 🛠️ Setup macOS
-        if: ${{  matrix.os == 'macos-latest' }}
-        run: |
-          rustup target add aarch64-apple-darwin
-
-      # Set up 32 bit systems
-
-      - name: 🛠️ Config Windows x86
-        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
-        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
-
-      - name: 🛠️ Config Linux x86
-        run: |
-          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
-        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}
-
-      # - name: 🔨 Build
-      #   run: cargo build --benches
-
-      # - name: ⬆ Upload build
-      #   uses: ./.github/actions/upload_artifacts
-      #   with:
-      #     name: benchmarks_${{ matrix.os }}_${{ matrix.bits }}
-
-      # Benchmarks ...
-
-      - name: 🏃🏻‍♀️ Benchmarks
-        run: cargo bench --verbose $RUST_TARGET_FLAG
-
-      - name: 🏃🏻‍♀️ Benchmarks Portable
-        run: |
-          cargo clean
-          LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo bench --verbose $RUST_TARGET_FLAG
-
-  mq_status:
-    if: |
-      always() &&
-      github.event_name ==  'workflow_dispatch' || github.event_name ==  'merge_group'
-    needs: [benchmarks]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Successful
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: exit 0
-      - name: Failing
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index aa893300c..f852b95a3 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [main, dev]
   pull_request:
+  merge_group:
 
 jobs:
   nix:
diff --git a/.github/workflows/platform.yml b/.github/workflows/platform.yml
index 3415ee2f3..074dea37d 100644
--- a/.github/workflows/platform.yml
+++ b/.github/workflows/platform.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: ["main", "dev", "*"]
   workflow_dispatch:
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/rust-bench.yml b/.github/workflows/rust-bench.yml
new file mode 100644
index 000000000..20644290d
--- /dev/null
+++ b/.github/workflows/rust-bench.yml
@@ -0,0 +1,98 @@
+name: Benchmark
+
+on:
+  workflow_dispatch:
+  merge_group:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    strategy:
+      fail-fast: true
+      matrix:
+        bits: [32, 64]
+        os:
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+        exclude:
+          # There's no such thing as 32-bit macOS
+          - bits: 32
+            os: "macos-latest"
+          # FIXME: Linking isn't working here yet for hacl #42
+          - bits: 32
+            os: "windows-latest"
+
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
+        if: ${{ matrix.bits == 64 }}
+
+      - name: ⚙️ Setup Ubuntu x86
+        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
+        run: |
+          rustup target add i686-unknown-linux-gnu
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib g++-multilib
+
+      - name: ⚙️ Setup Ubuntu x64
+        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
+        run: |
+          rustup target add aarch64-unknown-linux-gnu
+
+      - name: ⚙️ Setup macOS
+        if: ${{  matrix.os == 'macos-latest' }}
+        run: |
+          rustup target add aarch64-apple-darwin
+
+      # Set up 32 bit systems
+
+      - name: 🛠️ Config Windows x86
+        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
+        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
+
+      - name: 🛠️ Config Linux x86
+        run: |
+          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
+        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}
+
+      # Set up windows
+
+      - name: ⚙️ Setup Windows x86
+        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
+        shell: pwsh
+        run: |
+          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
+          vcpkg install openssl:x86-windows-static-md
+
+      - name: ⚙️ Setup Windows x64
+        if: ${{ matrix.bits == 64 && matrix.os == 'windows-latest' }}
+        shell: pwsh
+        run: |
+          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
+          vcpkg install openssl:x64-windows-static-md
+
+      # Benchmarks ...
+
+      - name: 🏃🏻‍♀️ Benchmarks
+        run: cargo bench --verbose $RUST_TARGET_FLAG -p benchmarks -- --output-format bencher | tee bench.txt
+      - name: Store Benchmarks
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          name: ML-KEM Benchmark
+          tool: 'cargo'
+          output-file-path: bench.txt
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          auto-push: true
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 7b4324a5c..552809ccd 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -141,90 +141,4 @@ jobs:
       - name: 🏃🏻‍♀️ Test
         run: CC=emcc AR=emar wasm-pack test --node --features wasm
 
-  benchmarks:
-    if: ${{ github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' }}
-    strategy:
-      fail-fast: true
-      matrix:
-        bits: [32, 64]
-        os:
-          - macos-latest
-          - ubuntu-latest
-          - windows-latest
-        exclude:
-          # There's no such thing as 32-bit macOS
-          - bits: 32
-            os: "macos-latest"
-          # FIXME: Linking isn't working here yet for hacl #42
-          - bits: 32
-            os: "windows-latest"
-
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        shell: bash
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
-        if: ${{ matrix.bits == 64 }}
-
-      - name: ⚙️ Setup Ubuntu x86
-        if: ${{ matrix.bits == 32 &&  matrix.os == 'ubuntu-latest' }}
-        run: |
-          rustup target add i686-unknown-linux-gnu
-          sudo apt-get update
-          sudo apt-get install -y gcc-multilib g++-multilib
-
-      - name: ⚙️ Setup Ubuntu x64
-        if: ${{ matrix.bits == 64 &&  matrix.os == 'ubuntu-latest' }}
-        run: |
-          rustup target add aarch64-unknown-linux-gnu
-
-      - name: ⚙️ Setup macOS
-        if: ${{  matrix.os == 'macos-latest' }}
-        run: |
-          rustup target add aarch64-apple-darwin
-
-      # Set up 32 bit systems
-
-      - name: 🛠️ Config Windows x86
-        run: echo "RUST_TARGET_FLAG=--target=i686-pc-windows-msvc" > $GITHUB_ENV
-        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
-
-      - name: 🛠️ Config Linux x86
-        run: |
-          echo "RUST_TARGET_FLAG=--target=i686-unknown-linux-gnu" > $GITHUB_ENV
-        if: ${{ matrix.bits == 32 && matrix.os == 'ubuntu-latest' }}
-
-      # Set up windows
-
-      - name: ⚙️ Setup Windows x86
-        if: ${{ matrix.bits == 32 && matrix.os == 'windows-latest' }}
-        shell: pwsh
-        run: |
-          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
-          vcpkg install openssl:x86-windows-static-md
-
-      - name: ⚙️ Setup Windows x64
-        if: ${{ matrix.bits == 64 && matrix.os == 'windows-latest' }}
-        shell: pwsh
-        run: |
-          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
-          vcpkg install openssl:x64-windows-static-md
-
-      # Benchmarks ...
-
-      - name: 🏃🏻‍♀️ Benchmarks
-        run: cargo bench --verbose $RUST_TARGET_FLAG -p benchmarks
-
-  mq_status:
-    if: |
-      always() &&
-      (github.event_name ==  'workflow_dispatch' || github.event_name ==  'merge_group')
-    needs: [benchmarks]
-    uses: cryspen/actions/.github/workflows/merge-queue-status.yml@jonas/merge-queue-status
-    with:
-      needs_json: "${{toJSON(needs)}}"
 
diff --git a/.github/workflows/skip-benches-in-prs.yml b/.github/workflows/skip-benches-in-prs.yml
new file mode 100644
index 000000000..fd259b985
--- /dev/null
+++ b/.github/workflows/skip-benches-in-prs.yml
@@ -0,0 +1,14 @@
+name: Skip Benchmarks in PRs
+
+on: [ pull_request ]
+jobs: 
+  benchmark:
+    runs-on: ubuntu-latest
+    steps:
+     - run: true
+  benchmarks:
+    runs-on: ubuntu-latest
+    steps:
+     - run: true
+
+
diff --git a/.github/workflows/specs.yml b/.github/workflows/specs.yml
index 83a79e802..383d45cdf 100644
--- a/.github/workflows/specs.yml
+++ b/.github/workflows/specs.yml
@@ -5,6 +5,7 @@ on:
     branches: [ "main", "dev" ]
   pull_request:
     branches: [ "main", "dev" ]
+  merge_group:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/Cargo.lock b/Cargo.lock
index d05b611e1..bf75533ab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -116,7 +116,7 @@ dependencies = [
  "p256",
  "pqcrypto-kyber",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "ring",
  "sha2",
  "sha3",
@@ -444,7 +444,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
@@ -456,7 +456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -494,7 +494,7 @@ checksum = "1c359b7249347e46fb28804470d071c921156ad62b3eef5d34e2ba867533dec8"
 dependencies = [
  "byteorder",
  "digest 0.9.0",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle-ng",
  "zeroize",
 ]
@@ -572,7 +572,7 @@ dependencies = [
  "hkdf",
  "pem-rfc7468",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "sec1",
  "subtle",
  "zeroize",
@@ -617,7 +617,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -685,7 +685,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -817,6 +817,48 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "hpke-rs"
+version = "0.2.0"
+source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
+dependencies = [
+ "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate)",
+ "log",
+ "serde",
+ "tls_codec",
+ "zeroize",
+]
+
+[[package]]
+name = "hpke-rs-crypto"
+version = "0.2.0"
+source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "hpke-rs-crypto"
+version = "0.2.0"
+source = "git+https://github.com/cryspen/hpke-rs.git#7c486f19188013f2546e185b9759918df6e02901"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "hpke-rs-tests"
+version = "0.1.0"
+source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
+dependencies = [
+ "hpke-rs",
+ "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate)",
+ "log",
+ "pretty_env_logger",
+ "rayon",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -937,6 +979,9 @@ dependencies = [
  "hax-lib 0.1.0-pre.1 (git+https://github.com/hacspec/hax/?branch=main)",
  "hax-lib-macros 0.1.0-pre.1 (git+https://github.com/hacspec/hax/?branch=main)",
  "hex",
+ "hpke-rs",
+ "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git)",
+ "hpke-rs-tests",
  "libcrux",
  "libcrux-ecdh",
  "libcrux-hacl",
@@ -950,7 +995,8 @@ dependencies = [
  "quickcheck",
  "quickcheck_macros",
  "rand",
- "rand_core",
+ "rand_core 0.2.2",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
  "wasm-bindgen",
@@ -965,7 +1011,7 @@ dependencies = [
  "libcrux-hacl",
  "pretty_env_logger",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
 ]
@@ -1046,7 +1092,7 @@ dependencies = [
  "libcrux-platform",
  "libcrux-sha3",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
 ]
@@ -1490,7 +1536,7 @@ checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
  "rand_chacha",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -1500,9 +1546,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1961a422c4d189dfb50ffa9320bf1f2a9bd54ecb92792fb9477f99a1045f3372"
+dependencies = [
+ "rand_core 0.3.1",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -1721,7 +1791,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest 0.10.7",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -1799,6 +1869,28 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "tls_codec"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e78c9c330f8c85b2bae7c8368f2739157db9991235123aa1b15ef9502bfb6a"
+dependencies = [
+ "serde",
+ "tls_codec_derive",
+ "zeroize",
+]
+
+[[package]]
+name = "tls_codec_derive"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d9ef545650e79f30233c0003bcc2504d7efac6dad25fca40744de773fe2049c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.75",
+]
+
 [[package]]
 name = "typenum"
 version = "1.17.0"
@@ -2083,7 +2175,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "zeroize",
 ]
@@ -2096,7 +2188,7 @@ checksum = "bf7074de8999662970c3c4c8f7f30925028dd8f4ca31ad4c055efa9cdf2ec326"
 dependencies = [
  "curve25519-dalek-ng",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "zeroize",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index b2e2765e3..bc12a28d2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -56,6 +56,7 @@ exclude = [
 
 [lib]
 crate-type = ["staticlib", "cdylib", "lib"]
+bench = false # so libtest doesn't eat the arguments for criterion
 
 [build-dependencies]
 libcrux-platform = { version = "=0.0.2-alpha.3", path = "sys/platform" }
@@ -72,6 +73,9 @@ rand = { version = "0.8" }
 log = { version = "0.4", optional = true }
 # WASM API
 wasm-bindgen = { version = "0.2.87", optional = true }
+hpke-rs = { version = "0.2.0", optional = true, git = "https://github.com/cryspen/hpke-rs.git", branch = "keks/tests-crate", package = "hpke-rs"}
+hpke-rs-crypto = { version = "0.2.0", optional = true, git = "https://github.com/cryspen/hpke-rs.git", package = "hpke-rs-crypto"}
+rand_core = { version = "0.2.0", optional = true}
 
 # When using the hax toolchain, we have more dependencies.
 # This is only required when doing proofs.
@@ -90,6 +94,7 @@ serde_json = { version = "1.0" }
 serde = { version = "1.0", features = ["derive"] }
 hex = { version = "0.4.3", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
+hpke-rs-tests = { git = "https://github.com/cryspen/hpke-rs.git", branch = "keks/tests-crate", package = "hpke-rs-tests" }
 
 [target.'cfg(target_arch = "wasm32")'.dev-dependencies]
 wasm-bindgen-test = "0.3"
diff --git a/libcrux-ml-kem/Cargo.toml b/libcrux-ml-kem/Cargo.toml
index c967a416b..1deaa591c 100644
--- a/libcrux-ml-kem/Cargo.toml
+++ b/libcrux-ml-kem/Cargo.toml
@@ -18,6 +18,9 @@ exclude = [
     "/hax.py",
 ]
 
+[lib]
+bench = false # so libtest doesn't eat the arguments to criterion
+
 [dependencies]
 rand_core = { version = "0.6" }
 libcrux-platform = { version = "0.0.2-alpha.3", path = "../sys/platform" }

From 11629c317e751a86278000da5072848c6c89f65d Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Thu, 22 Aug 2024 19:10:58 +0200
Subject: [PATCH 02/12] undo hpke

---
 Cargo.lock | 122 +++++++----------------------------------------------
 Cargo.toml |   4 --
 2 files changed, 15 insertions(+), 111 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bf75533ab..d05b611e1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -116,7 +116,7 @@ dependencies = [
  "p256",
  "pqcrypto-kyber",
  "rand",
- "rand_core 0.6.4",
+ "rand_core",
  "ring",
  "sha2",
  "sha3",
@@ -444,7 +444,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
  "zeroize",
 ]
@@ -456,7 +456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "typenum",
 ]
 
@@ -494,7 +494,7 @@ checksum = "1c359b7249347e46fb28804470d071c921156ad62b3eef5d34e2ba867533dec8"
 dependencies = [
  "byteorder",
  "digest 0.9.0",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle-ng",
  "zeroize",
 ]
@@ -572,7 +572,7 @@ dependencies = [
  "hkdf",
  "pem-rfc7468",
  "pkcs8",
- "rand_core 0.6.4",
+ "rand_core",
  "sec1",
  "subtle",
  "zeroize",
@@ -617,7 +617,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
@@ -685,7 +685,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
@@ -817,48 +817,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "hpke-rs"
-version = "0.2.0"
-source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
-dependencies = [
- "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate)",
- "log",
- "serde",
- "tls_codec",
- "zeroize",
-]
-
-[[package]]
-name = "hpke-rs-crypto"
-version = "0.2.0"
-source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
-dependencies = [
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "hpke-rs-crypto"
-version = "0.2.0"
-source = "git+https://github.com/cryspen/hpke-rs.git#7c486f19188013f2546e185b9759918df6e02901"
-dependencies = [
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "hpke-rs-tests"
-version = "0.1.0"
-source = "git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate#f3c072720227b8ec8c760aa97fa80c90a5f8272d"
-dependencies = [
- "hpke-rs",
- "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git?branch=keks/tests-crate)",
- "log",
- "pretty_env_logger",
- "rayon",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -979,9 +937,6 @@ dependencies = [
  "hax-lib 0.1.0-pre.1 (git+https://github.com/hacspec/hax/?branch=main)",
  "hax-lib-macros 0.1.0-pre.1 (git+https://github.com/hacspec/hax/?branch=main)",
  "hex",
- "hpke-rs",
- "hpke-rs-crypto 0.2.0 (git+https://github.com/cryspen/hpke-rs.git)",
- "hpke-rs-tests",
  "libcrux",
  "libcrux-ecdh",
  "libcrux-hacl",
@@ -995,8 +950,7 @@ dependencies = [
  "quickcheck",
  "quickcheck_macros",
  "rand",
- "rand_core 0.2.2",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "serde_json",
  "wasm-bindgen",
@@ -1011,7 +965,7 @@ dependencies = [
  "libcrux-hacl",
  "pretty_env_logger",
  "rand",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "serde_json",
 ]
@@ -1092,7 +1046,7 @@ dependencies = [
  "libcrux-platform",
  "libcrux-sha3",
  "rand",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "serde_json",
 ]
@@ -1536,7 +1490,7 @@ checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
  "rand_chacha",
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
 [[package]]
@@ -1546,33 +1500,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1961a422c4d189dfb50ffa9320bf1f2a9bd54ecb92792fb9477f99a1045f3372"
-dependencies = [
- "rand_core 0.3.1",
+ "rand_core",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
-dependencies = [
- "rand_core 0.4.2",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
-
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -1791,7 +1721,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest 0.10.7",
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
 [[package]]
@@ -1869,28 +1799,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "tls_codec"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e78c9c330f8c85b2bae7c8368f2739157db9991235123aa1b15ef9502bfb6a"
-dependencies = [
- "serde",
- "tls_codec_derive",
- "zeroize",
-]
-
-[[package]]
-name = "tls_codec_derive"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d9ef545650e79f30233c0003bcc2504d7efac6dad25fca40744de773fe2049c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.75",
-]
-
 [[package]]
 name = "typenum"
 version = "1.17.0"
@@ -2175,7 +2083,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "zeroize",
 ]
@@ -2188,7 +2096,7 @@ checksum = "bf7074de8999662970c3c4c8f7f30925028dd8f4ca31ad4c055efa9cdf2ec326"
 dependencies = [
  "curve25519-dalek-ng",
  "rand",
- "rand_core 0.6.4",
+ "rand_core",
  "zeroize",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index bc12a28d2..869a771a7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -73,9 +73,6 @@ rand = { version = "0.8" }
 log = { version = "0.4", optional = true }
 # WASM API
 wasm-bindgen = { version = "0.2.87", optional = true }
-hpke-rs = { version = "0.2.0", optional = true, git = "https://github.com/cryspen/hpke-rs.git", branch = "keks/tests-crate", package = "hpke-rs"}
-hpke-rs-crypto = { version = "0.2.0", optional = true, git = "https://github.com/cryspen/hpke-rs.git", package = "hpke-rs-crypto"}
-rand_core = { version = "0.2.0", optional = true}
 
 # When using the hax toolchain, we have more dependencies.
 # This is only required when doing proofs.
@@ -94,7 +91,6 @@ serde_json = { version = "1.0" }
 serde = { version = "1.0", features = ["derive"] }
 hex = { version = "0.4.3", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
-hpke-rs-tests = { git = "https://github.com/cryspen/hpke-rs.git", branch = "keks/tests-crate", package = "hpke-rs-tests" }
 
 [target.'cfg(target_arch = "wasm32")'.dev-dependencies]
 wasm-bindgen-test = "0.3"

From 9ddfa5e48085ea5d31d8cbf0e29b2868a6d6392c Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Thu, 22 Aug 2024 19:38:33 +0200
Subject: [PATCH 03/12] run tests in merge queue :face_palm:

---
 .github/workflows/rust.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 552809ccd..e519051ea 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -17,7 +17,6 @@ concurrency:
 
 jobs:
   build:
-    if:  ${{ github.event_name != 'merge_group' }}
     strategy:
       fail-fast: false
       matrix:

From 190bfd40dcb80fcdecd7d902c791bd4e194095b5 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 10:57:22 +0200
Subject: [PATCH 04/12] build gc before trying to bench it

---
 .github/workflows/c-bench.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/c-bench.yml b/.github/workflows/c-bench.yml
index a2628bf2e..9398a57db 100644
--- a/.github/workflows/c-bench.yml
+++ b/.github/workflows/c-bench.yml
@@ -22,26 +22,34 @@ jobs:
     defaults:
       run:
         shell: bash
-        working-directory: libcrux-ml-kem/c
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: 🔨 Build Release
+      - name: 🔨 Build libcrux-ml-kem/c
+        working-directory: libcrux-ml-kem/c
         run: |
           cmake -B build -DCMAKE_BUILD_TYPE=Release
           cmake --build build --config Release
 
       # FIXME: Benchmarks on Windows CI are not working right now.
       # - name: 🏃🏻‍♀️ Benchmark
+      #   working-directory: libcrux-ml-kem/c
       #   run: ./build/Release/ml_kem_bench
       #   if: ${{ matrix.os == 'windows-latest' }}
 
-      - name: 🏃🏻‍♀️ Benchmark (c)
+      - name: 🏃🏻‍♀️ Benchmark (libcrux-ml-kem/c)
+        working-directory: libcrux-ml-kem/c
         run: ./build/ml_kem_bench
         if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
 
-      - name: 🏃🏻‍♀️ Benchmark (cg)
+      - name: 🔨 Build libcrux-ml-kem/cg
+        working-directory: libcrux-ml-kem/cg
+        run: |
+          cmake -B build -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --config Release
+
+      - name: 🏃🏻‍♀️ Benchmark libcrux-ml-kem/cg
         working-directory: libcrux-ml-kem/cg
         run: ./build/ml_kem_bench
         if: ${{ matrix.os != 'windows-latest' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}

From e995f6a7444ebf0d5168497115cda38aafe0ffb0 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 10:59:19 +0200
Subject: [PATCH 05/12] disable libtest for benches in ./benchmarks/

---
 benchmarks/Cargo.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/benchmarks/Cargo.toml b/benchmarks/Cargo.toml
index 3e9f3b781..21a2c3dc3 100644
--- a/benchmarks/Cargo.toml
+++ b/benchmarks/Cargo.toml
@@ -9,6 +9,9 @@ repository.workspace = true
 readme.workspace = true
 publish = false
 
+[lib]
+bench = false # so libtest doesn't eat the arguments for criterion
+
 [dependencies]
 
 [dev-dependencies]

From 802eccdf88224ceef62c7a02c9c96e394140f940 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 13:33:13 +0200
Subject: [PATCH 06/12] bench = false in the rest of the benchmarked rust
 packages

---
 libcrux-ml-dsa/Cargo.toml | 3 +++
 libcrux-psq/Cargo.toml    | 3 +++
 libcrux-sha3/Cargo.toml   | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/libcrux-ml-dsa/Cargo.toml b/libcrux-ml-dsa/Cargo.toml
index 5408a697b..0eb6a57f8 100644
--- a/libcrux-ml-dsa/Cargo.toml
+++ b/libcrux-ml-dsa/Cargo.toml
@@ -10,6 +10,9 @@ readme.workspace = true
 description = "Libcrux ML-DSA implementation"
 publish = false
 
+[lib]
+bench = false # so libtest doesn't eat the arguments to criterion
+
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
diff --git a/libcrux-psq/Cargo.toml b/libcrux-psq/Cargo.toml
index 8f9bb74b1..4e0f7395d 100644
--- a/libcrux-psq/Cargo.toml
+++ b/libcrux-psq/Cargo.toml
@@ -10,6 +10,9 @@ readme.workspace = true
 description = "Libcrux Pre-Shared post-Quantum key establishement protocol"
 publish = false
 
+[lib]
+bench = false # so libtest doesn't eat the arguments to criterion
+
 [dependencies]
 libcrux-kem = { version = "0.0.2-alpha.3", path = "../libcrux-kem", features = [
     "pre-verification",
diff --git a/libcrux-sha3/Cargo.toml b/libcrux-sha3/Cargo.toml
index c93712c4b..ebf3dde70 100644
--- a/libcrux-sha3/Cargo.toml
+++ b/libcrux-sha3/Cargo.toml
@@ -10,6 +10,9 @@ readme = "README.md"
 description = "Libcrux SHA-3 implementation"
 exclude = ["/proofs", "/c.sh", "/c.yaml", "/tests/tv", "tests/cavp.rs"]
 
+[lib]
+bench = false # so libtest doesn't eat the arguments to criterion
+
 [dependencies]
 libcrux-platform = { version = "0.0.2-alpha.3", path = "../sys/platform" }
 libcrux-intrinsics = { version = "0.0.2-alpha.3", path = "../libcrux-intrinsics" }

From b4e38dd90a3fc26ba16d2d0b891d6504d0959611 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 13:34:10 +0200
Subject: [PATCH 07/12] disable c bench for windows

---
 .github/workflows/c-bench.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/c-bench.yml b/.github/workflows/c-bench.yml
index 9398a57db..04d03d819 100644
--- a/.github/workflows/c-bench.yml
+++ b/.github/workflows/c-bench.yml
@@ -16,7 +16,7 @@ jobs:
         os:
           - macos-latest
           - ubuntu-latest
-          - windows-latest
+          # - windows-latest # currently runs forever, needs to be investigated before adding again!
 
     runs-on: ${{ matrix.os }}
     defaults:

From 13aa81f0c6012c628171db35c25377444714129a Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 14:10:46 +0200
Subject: [PATCH 08/12] steps towards getting wasm to work, but disable it for
 now because it still doesn't

---
 .github/workflows/rust.yml | 2 +-
 Cargo.toml                 | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index e519051ea..c09f98d06 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -122,7 +122,7 @@ jobs:
         run: cargo build --verbose $RUST_TARGET_FLAG
 
   wasm:
-    if: ${{ github.event_name == 'workflow_dispatch'  || github.event_name == 'merge_group'  }}
+    if: false #${{ github.event_name == 'workflow_dispatch'  || github.event_name == 'merge_group'  }}
     runs-on: ubuntu-latest
 
     steps:
diff --git a/Cargo.toml b/Cargo.toml
index 869a771a7..3bd1be7a9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -73,6 +73,7 @@ rand = { version = "0.8" }
 log = { version = "0.4", optional = true }
 # WASM API
 wasm-bindgen = { version = "0.2.87", optional = true }
+getrandom = { version = "0.2", features = ["js"], optional = true }
 
 # When using the hax toolchain, we have more dependencies.
 # This is only required when doing proofs.
@@ -99,7 +100,7 @@ getrandom = { version = "0.2", features = ["js"] }
 [features]
 hacspec = []            # TODO: #7 Use specs instead of efficient implementations
 rand = []
-wasm = ["wasm-bindgen"]
+wasm = ["wasm-bindgen", "getrandom"]
 log = ["dep:log"]
 tests = []              # Expose functions for testing.
 experimental = []       # Expose experimental APIs.

From c3e4c58bcc3013501f5282dddfca1d62f914e4b9 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 16:21:07 +0200
Subject: [PATCH 09/12] final touches on benchmarks

had to move the utils into the crate, because otherwise it would be
picked up by the bechmarks and fail because libtest would again complain
about the --output-format argument
---
 benchmarks/Cargo.toml        |  2 +-
 benchmarks/benches/aead.rs   |  3 +--
 benchmarks/benches/p256.rs   |  1 -
 benchmarks/benches/sha2.rs   |  3 +--
 benchmarks/benches/sha3.rs   |  3 +--
 benchmarks/benches/util.rs   | 16 ----------------
 benchmarks/benches/x25519.rs |  3 +--
 benchmarks/src/lib.rs        | 15 +++++++++++++++
 8 files changed, 20 insertions(+), 26 deletions(-)
 delete mode 100644 benchmarks/benches/util.rs

diff --git a/benchmarks/Cargo.toml b/benchmarks/Cargo.toml
index 21a2c3dc3..3458bfeda 100644
--- a/benchmarks/Cargo.toml
+++ b/benchmarks/Cargo.toml
@@ -13,12 +13,12 @@ publish = false
 bench = false # so libtest doesn't eat the arguments for criterion
 
 [dependencies]
+rand = { version = "0.8" }
 
 [dev-dependencies]
 libcrux = { path = "../", features = ["rand", "tests"] }
 libcrux-kem = { path = "../libcrux-kem", features = ["tests"] }
 libcrux-ml-kem = { path = "../libcrux-ml-kem" }
-rand = { version = "0.8" }
 rand_core = { version = "0.6" }
 # Benchmarking "RustCrypto"
 chacha20poly1305 = "0.10"
diff --git a/benchmarks/benches/aead.rs b/benchmarks/benches/aead.rs
index 94994baf3..bfb74a25a 100644
--- a/benchmarks/benches/aead.rs
+++ b/benchmarks/benches/aead.rs
@@ -2,10 +2,9 @@ use chacha20poly1305::{AeadCore, AeadInPlace, KeyInit};
 use criterion::{criterion_group, criterion_main, BatchSize, BenchmarkId, Criterion, Throughput};
 use libcrux::{aead::*, digest, drbg};
 
-mod util;
+use benchmarks::util::*;
 use rand_core::OsRng;
 use ring::aead::UnboundKey;
-use util::*;
 
 // Comparing libcrux performance for different payload sizes and other implementations.
 fn comparisons_encrypt(c: &mut Criterion) {
diff --git a/benchmarks/benches/p256.rs b/benchmarks/benches/p256.rs
index a562bebd2..70296411e 100644
--- a/benchmarks/benches/p256.rs
+++ b/benchmarks/benches/p256.rs
@@ -1,7 +1,6 @@
 use criterion::{criterion_group, criterion_main, BatchSize, Criterion};
 use libcrux::ecdh;
 
-mod util;
 use rand_core::OsRng;
 
 fn derive(c: &mut Criterion) {
diff --git a/benchmarks/benches/sha2.rs b/benchmarks/benches/sha2.rs
index d9f82577e..5e3f16b2b 100644
--- a/benchmarks/benches/sha2.rs
+++ b/benchmarks/benches/sha2.rs
@@ -3,8 +3,7 @@ use criterion::{criterion_group, criterion_main, BatchSize, BenchmarkId, Criteri
 
 use libcrux::digest::{self, *};
 
-mod util;
-use util::*;
+use benchmarks::util::*;
 
 macro_rules! impl_comp {
     ($fun:ident, $libcrux:expr, $ring:expr, $rust_crypto:ty, $openssl:expr) => {
diff --git a/benchmarks/benches/sha3.rs b/benchmarks/benches/sha3.rs
index ca9deb998..dbf2494d7 100644
--- a/benchmarks/benches/sha3.rs
+++ b/benchmarks/benches/sha3.rs
@@ -3,8 +3,7 @@ use criterion::{criterion_group, criterion_main, BatchSize, BenchmarkId, Criteri
 
 use libcrux::digest::{self, *};
 
-mod util;
-use util::*;
+use benchmarks::util::*;
 
 macro_rules! impl_comp {
     ($fun:ident, $libcrux:expr, $rust_crypto:ty, $openssl:expr) => {
diff --git a/benchmarks/benches/util.rs b/benchmarks/benches/util.rs
deleted file mode 100644
index 1e7439e8e..000000000
--- a/benchmarks/benches/util.rs
+++ /dev/null
@@ -1,16 +0,0 @@
-#![allow(dead_code)]
-
-pub fn randombytes(n: usize) -> Vec<u8> {
-    use rand::rngs::OsRng;
-    use rand::RngCore;
-
-    let mut bytes = vec![0u8; n];
-    OsRng.fill_bytes(&mut bytes);
-    bytes
-}
-
-pub fn fmt(x: usize) -> String {
-    let base = (x as f64).log(1024f64).floor() as usize;
-    let suffix = ["", "KB", "MB", "GB"];
-    format!("{} {}", x >> (10 * base), suffix[base])
-}
diff --git a/benchmarks/benches/x25519.rs b/benchmarks/benches/x25519.rs
index a9d9b793d..af5730814 100644
--- a/benchmarks/benches/x25519.rs
+++ b/benchmarks/benches/x25519.rs
@@ -1,9 +1,8 @@
 use criterion::{criterion_group, criterion_main, BatchSize, Criterion};
 use libcrux::ecdh;
 
-mod util;
+use benchmarks::util::*;
 use rand::RngCore;
-use util::*;
 
 fn derive(c: &mut Criterion) {
     // Comparing libcrux performance for different payload sizes and other implementations.
diff --git a/benchmarks/src/lib.rs b/benchmarks/src/lib.rs
index 8b1378917..293e5e4c7 100644
--- a/benchmarks/src/lib.rs
+++ b/benchmarks/src/lib.rs
@@ -1 +1,16 @@
+pub mod util {
+    pub fn randombytes(n: usize) -> Vec<u8> {
+        use rand::rngs::OsRng;
+        use rand::RngCore;
 
+        let mut bytes = vec![0u8; n];
+        OsRng.fill_bytes(&mut bytes);
+        bytes
+    }
+
+    pub fn fmt(x: usize) -> String {
+        let base = (x as f64).log(1024f64).floor() as usize;
+        let suffix = ["", "KB", "MB", "GB"];
+        format!("{} {}", x >> (10 * base), suffix[base])
+    }
+}

From 30af7dd6a38da3d0b39348e989e8b2fcb84cf198 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Mon, 26 Aug 2024 17:40:32 +0200
Subject: [PATCH 10/12] split up benchmarks and fix git issue

---
 .github/workflows/mlkem-bench.yml         |  2 ++
 .github/workflows/skip-benches-in-prs.yml | 27 +++++++++++++++++++----
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/mlkem-bench.yml b/.github/workflows/mlkem-bench.yml
index b5c825c09..a6bf66508 100644
--- a/.github/workflows/mlkem-bench.yml
+++ b/.github/workflows/mlkem-bench.yml
@@ -89,6 +89,8 @@ jobs:
         run: |
           cargo clean
           LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo bench --verbose $RUST_TARGET_FLAG -- --output-format bencher | sed 's/^test \(.*\) \.\.\. bench/test portable \1 ... bench/' | tee -a bench.txt 
+      - name: Clear Cargo.toml so it doesn't interfere with git
+        run: git checkout Cargo.toml
       - name: Store benchmarks
         uses: benchmark-action/github-action-benchmark@v1
         with:
diff --git a/.github/workflows/skip-benches-in-prs.yml b/.github/workflows/skip-benches-in-prs.yml
index fd259b985..27d9cb4bc 100644
--- a/.github/workflows/skip-benches-in-prs.yml
+++ b/.github/workflows/skip-benches-in-prs.yml
@@ -1,14 +1,33 @@
 name: Skip Benchmarks in PRs
 
 on: [ pull_request ]
+
 jobs: 
   benchmark:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        bits: [32, 64]
+        os:
+          - macos-13
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+    runs-on: ${{ matrix.os }}
     steps:
      - run: true
-  benchmarks:
-    runs-on: ubuntu-latest
+
+  benchmark_without_bits:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-13
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+    runs-on: ${{ matrix.os }}
+    name: "benchmark (${{ matrix.os }})"
     steps:
      - run: true
 
-

From 496c9d3595e6d49497580529adf182db172e1e85 Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Tue, 27 Aug 2024 09:57:35 +0200
Subject: [PATCH 11/12] fix more benchmark workflows

---
 .github/workflows/mlkem-bench.yml | 4 ++--
 .github/workflows/rust-bench.yml  | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mlkem-bench.yml b/.github/workflows/mlkem-bench.yml
index a6bf66508..5f049aaca 100644
--- a/.github/workflows/mlkem-bench.yml
+++ b/.github/workflows/mlkem-bench.yml
@@ -89,8 +89,8 @@ jobs:
         run: |
           cargo clean
           LIBCRUX_DISABLE_SIMD128=1 LIBCRUX_DISABLE_SIMD256=1 cargo bench --verbose $RUST_TARGET_FLAG -- --output-format bencher | sed 's/^test \(.*\) \.\.\. bench/test portable \1 ... bench/' | tee -a bench.txt 
-      - name: Clear Cargo.toml so it doesn't interfere with git
-        run: git checkout Cargo.toml
+      - name: Clear Cargo.lock so it doesn't interfere with git
+        run: git checkout Cargo.lock
       - name: Store benchmarks
         uses: benchmark-action/github-action-benchmark@v1
         with:
diff --git a/.github/workflows/rust-bench.yml b/.github/workflows/rust-bench.yml
index 20644290d..787026950 100644
--- a/.github/workflows/rust-bench.yml
+++ b/.github/workflows/rust-bench.yml
@@ -88,10 +88,12 @@ jobs:
 
       - name: 🏃🏻‍♀️ Benchmarks
         run: cargo bench --verbose $RUST_TARGET_FLAG -p benchmarks -- --output-format bencher | tee bench.txt
+      - name: Clear Cargo.lock so it doesn't interfere with git
+        run: git checkout Cargo.lock
       - name: Store Benchmarks
         uses: benchmark-action/github-action-benchmark@v1
         with:
-          name: ML-KEM Benchmark
+          name: Rust Benchmark
           tool: 'cargo'
           output-file-path: bench.txt
           github-token: ${{ secrets.GITHUB_TOKEN }}

From 6108ada8d720d9195f7a69a17bcb206cbf648c0f Mon Sep 17 00:00:00 2001
From: "Jan Winkelmann (keks)" <jan@cryspen.com>
Date: Tue, 27 Aug 2024 13:30:24 +0200
Subject: [PATCH 12/12] figure out which files need to be reset

---
 .github/workflows/rust-bench.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/rust-bench.yml b/.github/workflows/rust-bench.yml
index 787026950..1ba9971c5 100644
--- a/.github/workflows/rust-bench.yml
+++ b/.github/workflows/rust-bench.yml
@@ -88,8 +88,10 @@ jobs:
 
       - name: 🏃🏻‍♀️ Benchmarks
         run: cargo bench --verbose $RUST_TARGET_FLAG -p benchmarks -- --output-format bencher | tee bench.txt
-      - name: Clear Cargo.lock so it doesn't interfere with git
-        run: git checkout Cargo.lock
+      - name: Print Git Status
+        run: git status
+      - name: Print Git Diff
+        run: git diff
       - name: Store Benchmarks
         uses: benchmark-action/github-action-benchmark@v1
         with: