From 8144168ace03443d2a7f05ae30dc844c2552ebcf Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Thu, 29 Oct 2026 14:11:42 +0100 Subject: [PATCH 1/2] fix(deps): resolve RustSec advisories and restore cargo-deny Signed-off-by: Adrien Langou --- Cargo.lock | 341 +++--------------- Cargo.toml | 3 +- crates/openshell-cli/Cargo.toml | 1 - crates/openshell-cli/src/tls.rs | 10 +- crates/openshell-core/Cargo.toml | 1 - crates/openshell-core/src/driver_utils.rs | 7 +- crates/openshell-core/src/grpc_client.rs | 8 +- crates/openshell-crypto/README.md | 3 +- crates/openshell-driver-vm/Cargo.toml | 2 +- crates/openshell-driver-vm/src/driver.rs | 22 ++ crates/openshell-sandbox-backend/Cargo.toml | 1 - .../openshell-sandbox-backend/src/runtime.rs | 15 +- .../src/runtime/test_support.rs | 7 +- .../src/runtime_routed.rs | 7 +- crates/openshell-sandbox/Cargo.toml | 1 - .../openshell-sandbox/src/boundary_server.rs | 14 +- crates/openshell-server/Cargo.toml | 1 - .../openshell-server/src/auth/sandbox_jwt.rs | 8 +- crates/openshell-server/src/config_file.rs | 9 +- crates/openshell-server/src/network_trust.rs | 14 +- crates/openshell-server/src/tls.rs | 23 +- crates/openshell-server/tests/common/mod.rs | 5 +- .../tests/edge_tunnel_auth.rs | 9 +- .../tests/multiplex_tls_integration.rs | 9 +- crates/openshell-server/tests/spiffe_jwt.rs | 64 ++++ .../openshell-supervisor-network/Cargo.toml | 1 - .../src/l7/tls.rs | 21 +- .../src/proxy/relay.rs | 3 +- deny.toml | 15 +- e2e/rust/Cargo.lock | 10 - e2e/rust/Cargo.toml | 1 - e2e/rust/tests/service_bearer_passthrough.rs | 10 +- examples/governance-interceptor/Cargo.lock | 14 +- examples/isolation-backend-v8/Cargo.lock | 16 +- examples/isolation-backend-v8/Cargo.toml | 1 - .../isolation-backend-v8/src/lifecycle.rs | 7 +- .../Cargo.lock | 14 +- tests/suites/conformance/Cargo.lock | 18 +- tests/suites/features/Cargo.lock | 10 - tests/testkit/Cargo.lock | 18 +- 40 files changed, 269 insertions(+), 475 deletions(-) create mode 100644 crates/openshell-server/tests/spiffe_jwt.rs diff --git a/Cargo.lock b/Cargo.lock index 59150547fc..781481d94e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -144,9 +144,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "apollo-parser" @@ -766,12 +766,6 @@ dependencies = [ "backtrace", ] -[[package]] -name = "base16ct" -version = "0.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" - [[package]] name = "base16ct" version = "1.0.0" @@ -1377,9 +1371,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" dependencies = [ "crossbeam-utils", ] @@ -1442,18 +1436,6 @@ dependencies = [ "winapi", ] -[[package]] -name = "crypto-bigint" -version = "0.5.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" -dependencies = [ - "generic-array 0.14.7", - "rand_core 0.6.4", - "subtle", - "zeroize", -] - [[package]] name = "crypto-bigint" version = "0.7.10" @@ -1498,7 +1480,7 @@ version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f" dependencies = [ - "crypto-bigint 0.7.10", + "crypto-bigint", "rand_core 0.10.1", ] @@ -1531,22 +1513,6 @@ dependencies = [ "subtle", ] -[[package]] -name = "curve25519-dalek" -version = "4.1.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" -dependencies = [ - "cfg-if", - "cpufeatures 0.2.17", - "curve25519-dalek-derive", - "digest 0.10.7", - "fiat-crypto 0.2.9", - "rustc_version", - "subtle", - "zeroize", -] - [[package]] name = "curve25519-dalek" version = "5.0.0" @@ -1557,7 +1523,7 @@ dependencies = [ "cpufeatures 0.3.0", "curve25519-dalek-derive", "digest 0.11.2", - "fiat-crypto 0.3.0", + "fiat-crypto", "rand_core 0.10.1", "rustc_version", "subtle", @@ -1902,20 +1868,6 @@ version = "1.0.20" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" -[[package]] -name = "ecdsa" -version = "0.16.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" -dependencies = [ - "der 0.7.10", - "digest 0.10.7", - "elliptic-curve 0.13.8", - "rfc6979 0.4.0", - "signature 2.2.0", - "spki 0.7.3", -] - [[package]] name = "ecdsa" version = "0.17.0" @@ -1924,23 +1876,13 @@ checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0" dependencies = [ "der 0.8.2", "digest 0.11.2", - "elliptic-curve 0.14.1", - "rfc6979 0.6.0", + "elliptic-curve", + "rfc6979", "signature 3.0.0", "spki 0.8.0", "zeroize", ] -[[package]] -name = "ed25519" -version = "2.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" -dependencies = [ - "pkcs8 0.10.2", - "signature 2.2.0", -] - [[package]] name = "ed25519" version = "3.0.0" @@ -1951,28 +1893,14 @@ dependencies = [ "signature 3.0.0", ] -[[package]] -name = "ed25519-dalek" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" -dependencies = [ - "curve25519-dalek 4.1.3", - "ed25519 2.2.3", - "serde", - "sha2 0.10.9", - "subtle", - "zeroize", -] - [[package]] name = "ed25519-dalek" version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de" dependencies = [ - "curve25519-dalek 5.0.0", - "ed25519 3.0.0", + "curve25519-dalek", + "ed25519", "rand_core 0.10.1", "serde", "sha2 0.11.0", @@ -2002,45 +1930,24 @@ dependencies = [ "serde", ] -[[package]] -name = "elliptic-curve" -version = "0.13.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" -dependencies = [ - "base16ct 0.2.0", - "crypto-bigint 0.5.5", - "digest 0.10.7", - "ff 0.13.1", - "generic-array 0.14.7", - "group 0.13.0", - "hkdf 0.12.4", - "pem-rfc7468 0.7.0", - "pkcs8 0.10.2", - "rand_core 0.6.4", - "sec1 0.7.3", - "subtle", - "zeroize", -] - [[package]] name = "elliptic-curve" version = "0.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65" dependencies = [ - "base16ct 1.0.0", - "crypto-bigint 0.7.10", + "base16ct", + "crypto-bigint", "crypto-common 0.2.2", "digest 0.11.2", - "ff 0.14.0", - "group 0.14.0", - "hkdf 0.13.0", + "ff", + "group", + "hkdf", "hybrid-array", "pem-rfc7468 1.0.0", "pkcs8 0.11.0", "rand_core 0.10.1", - "sec1 0.8.1", + "sec1", "subtle", "zeroize", ] @@ -2195,16 +2102,6 @@ version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6" -[[package]] -name = "ff" -version = "0.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393" -dependencies = [ - "rand_core 0.6.4", - "subtle", -] - [[package]] name = "ff" version = "0.14.0" @@ -2215,12 +2112,6 @@ dependencies = [ "subtle", ] -[[package]] -name = "fiat-crypto" -version = "0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" - [[package]] name = "fiat-crypto" version = "0.3.0" @@ -2465,7 +2356,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", - "zeroize", ] [[package]] @@ -2591,24 +2481,13 @@ dependencies = [ "wasm-bindgen", ] -[[package]] -name = "group" -version = "0.13.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" -dependencies = [ - "ff 0.13.1", - "rand_core 0.6.4", - "subtle", -] - [[package]] name = "group" version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4" dependencies = [ - "ff 0.14.0", + "ff", "rand_core 0.10.1", "subtle", ] @@ -2747,15 +2626,6 @@ dependencies = [ "url", ] -[[package]] -name = "hkdf" -version = "0.12.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" -dependencies = [ - "hmac 0.12.1", -] - [[package]] name = "hkdf" version = "0.13.0" @@ -3505,18 +3375,11 @@ checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1" dependencies = [ "aws-lc-rs", "base64 0.22.1", - "ed25519-dalek 2.2.0", "getrandom 0.2.17", - "hmac 0.12.1", "js-sys", - "p256 0.13.2", - "p384 0.13.1", "pem 3.0.6", - "rand 0.8.6", - "rsa 0.9.10", "serde", "serde_json", - "sha2 0.10.9", "signature 2.2.0", "simple_asn1", ] @@ -4511,7 +4374,6 @@ dependencies = [ "rcgen", "reqwest 0.12.28", "rustls", - "rustls-pemfile", "serde", "serde_json", "tar", @@ -4562,7 +4424,6 @@ dependencies = [ "reqwest 0.12.28", "rustix 1.1.4", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -4858,7 +4719,7 @@ dependencies = [ "tracing-opentelemetry", "tracing-subscriber", "url", - "zstd 0.13.3", + "zstd", ] [[package]] @@ -5097,7 +4958,6 @@ dependencies = [ "russh-sftp", "rustix 1.1.4", "rustls", - "rustls-pemfile", "seccompiler", "serde", "serde_json", @@ -5131,7 +4991,6 @@ dependencies = [ "rcgen", "rustix 1.1.4", "rustls", - "rustls-pemfile", "serde", "serde_json", "socket2", @@ -5244,7 +5103,6 @@ dependencies = [ "russh", "rustix 1.1.4", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -5420,7 +5278,6 @@ dependencies = [ "rustix 1.1.4", "rustls", "rustls-native-certs", - "rustls-pemfile", "serde", "serde_json", "sha1 0.10.6", @@ -5617,54 +5474,30 @@ version = "4.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d" -[[package]] -name = "p256" -version = "0.13.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" -dependencies = [ - "ecdsa 0.16.9", - "elliptic-curve 0.13.8", - "primeorder 0.13.6", - "sha2 0.10.9", -] - [[package]] name = "p256" version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a" dependencies = [ - "ecdsa 0.17.0", - "elliptic-curve 0.14.1", + "ecdsa", + "elliptic-curve", "primefield", - "primeorder 0.14.0", + "primeorder", "sha2 0.11.0", ] -[[package]] -name = "p384" -version = "0.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" -dependencies = [ - "ecdsa 0.16.9", - "elliptic-curve 0.13.8", - "primeorder 0.13.6", - "sha2 0.10.9", -] - [[package]] name = "p384" version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f" dependencies = [ - "ecdsa 0.17.0", - "elliptic-curve 0.14.1", - "fiat-crypto 0.3.0", + "ecdsa", + "elliptic-curve", + "fiat-crypto", "primefield", - "primeorder 0.14.0", + "primeorder", "sha2 0.11.0", ] @@ -5674,11 +5507,11 @@ version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449" dependencies = [ - "base16ct 1.0.0", - "ecdsa 0.17.0", - "elliptic-curve 0.14.1", + "base16ct", + "ecdsa", + "elliptic-curve", "primefield", - "primeorder 0.14.0", + "primeorder", "sha2 0.11.0", ] @@ -5688,7 +5521,7 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6d8eab09a361a4afe0b1668be978cd97e4f052e927a92b0b608cf902965d49ce" dependencies = [ - "base16ct 1.0.0", + "base16ct", "byteorder", "bytes", "delegate", @@ -6149,30 +5982,21 @@ version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4" dependencies = [ - "crypto-bigint 0.7.10", + "crypto-bigint", "crypto-common 0.2.2", - "ff 0.14.0", + "ff", "rand_core 0.10.1", "subtle", "zeroize", ] -[[package]] -name = "primeorder" -version = "0.13.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" -dependencies = [ - "elliptic-curve 0.13.8", -] - [[package]] name = "primeorder" version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06" dependencies = [ - "elliptic-curve 0.14.1", + "elliptic-curve", "once_cell", "primefield", "serdect", @@ -6342,9 +6166,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" [[package]] name = "pulldown-cmark" -version = "0.13.3" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags 2.13.2", "memchr", @@ -6852,23 +6676,13 @@ dependencies = [ "web-sys", ] -[[package]] -name = "rfc6979" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" -dependencies = [ - "hmac 0.12.1", - "subtle", -] - [[package]] name = "rfc6979" version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b" dependencies = [ - "crypto-bigint 0.7.10", + "crypto-bigint", "hmac 0.13.0", ] @@ -6925,7 +6739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf" dependencies = [ "const-oid 0.10.2", - "crypto-bigint 0.7.10", + "crypto-bigint", "crypto-primes", "digest 0.11.2", "pkcs1 0.8.0-rc.4", @@ -6951,16 +6765,16 @@ dependencies = [ "bytes", "cbc", "cipher", - "crypto-bigint 0.7.10", + "crypto-bigint", "ctr", - "curve25519-dalek 5.0.0", + "curve25519-dalek", "data-encoding", "delegate", "der 0.8.2", "digest 0.11.2", - "ecdsa 0.17.0", - "ed25519-dalek 3.0.0", - "elliptic-curve 0.14.1", + "ecdsa", + "ed25519-dalek", + "elliptic-curve", "enum_dispatch", "flate2", "futures", @@ -6976,8 +6790,8 @@ dependencies = [ "ml-kem", "module-lattice", "num-bigint 0.5.1", - "p256 0.14.0", - "p384 0.14.0", + "p256", + "p384", "p521", "pageant", "pbkdf2", @@ -6992,7 +6806,7 @@ dependencies = [ "russh-util", "salsa20", "scrypt", - "sec1 0.8.1", + "sec1", "sha1 0.11.0", "sha2 0.11.0", "sha3 0.12.0", @@ -7142,15 +6956,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.14.0" @@ -7282,27 +7087,13 @@ dependencies = [ "sha2 0.11.0", ] -[[package]] -name = "sec1" -version = "0.7.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" -dependencies = [ - "base16ct 0.2.0", - "der 0.7.10", - "generic-array 0.14.7", - "pkcs8 0.10.2", - "subtle", - "zeroize", -] - [[package]] name = "sec1" version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d" dependencies = [ - "base16ct 1.0.0", + "base16ct", "ctutils", "der 0.8.2", "hybrid-array", @@ -7494,7 +7285,7 @@ version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9af4a3e75ebd5599b30d4de5768e00b5095d518a79fefc3ecbaf77e665d1ec06" dependencies = [ - "base16ct 1.0.0", + "base16ct", "serde", ] @@ -7907,7 +7698,7 @@ dependencies = [ "futures-core", "futures-util", "hex", - "hkdf 0.13.0", + "hkdf", "hmac 0.13.0", "itoa", "log", @@ -7975,7 +7766,7 @@ checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e" dependencies = [ "base64ct", "bytes", - "crypto-bigint 0.7.10", + "crypto-bigint", "ctutils", "digest 0.11.2", "pem-rfc7468 1.0.0", @@ -7991,15 +7782,15 @@ dependencies = [ "argon2", "bcrypt-pbkdf", "ctutils", - "ed25519-dalek 3.0.0", + "ed25519-dalek", "hex", "hmac 0.13.0", - "p256 0.14.0", - "p384 0.14.0", + "p256", + "p384", "p521", "rand_core 0.10.1", "rsa 0.10.0-rc.18", - "sec1 0.8.1", + "sec1", "sha1 0.11.0", "sha2 0.11.0", "signature 3.0.0", @@ -9854,8 +9645,8 @@ version = "0.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa" dependencies = [ - "ff 0.14.0", - "group 0.14.0", + "ff", + "group", "hybrid-array", "primefield", ] @@ -10108,7 +9899,7 @@ dependencies = [ "windows-sys 0.61.2", "zeroize", "zopfli", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -10135,31 +9926,13 @@ dependencies = [ "simd-adler32", ] -[[package]] -name = "zstd" -version = "0.13.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" -dependencies = [ - "zstd-safe 7.2.4", -] - [[package]] name = "zstd" version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ - "zstd-safe 8.2.0", -] - -[[package]] -name = "zstd-safe" -version = "7.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" -dependencies = [ - "zstd-sys", + "zstd-safe", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 985cfd6c43..736514b092 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -42,7 +42,6 @@ h2 = "0.4" # TLS tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12"] } rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12"] } -rustls-pemfile = "2" rcgen = { version = "0.14.10", default-features = false, features = ["pem"] } webpki-roots = "1" rustls-native-certs = "0.8" @@ -117,7 +116,7 @@ jsonwebtoken = { version = "10", default-features = false, features = ["use_pem" zeroize = { version = "1", features = ["derive"] } getrandom = "0.3" aws-lc-rs = "1.16" -spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "jwt-verify-rust-crypto", "tracing"] } +spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "jwt-verify-aws-lc-rs", "tracing"] } # Filesystem embedding include_dir = "0.7" diff --git a/crates/openshell-cli/Cargo.toml b/crates/openshell-cli/Cargo.toml index bc7266e4a4..0cdd32ade0 100644 --- a/crates/openshell-cli/Cargo.toml +++ b/crates/openshell-cli/Cargo.toml @@ -53,7 +53,6 @@ hyper = { workspace = true } hyper-util = { workspace = true } hyper-rustls = { version = "0.27", default-features = false, features = ["native-tokio", "http1", "http2", "tls12", "logging"] } rustls = { workspace = true } -rustls-pemfile = { workspace = true } reqwest = { workspace = true } # Error handling diff --git a/crates/openshell-cli/src/tls.rs b/crates/openshell-cli/src/tls.rs index d34e92de27..81a1bbe5f2 100644 --- a/crates/openshell-cli/src/tls.rs +++ b/crates/openshell-cli/src/tls.rs @@ -9,7 +9,7 @@ use openshell_sdk::{AuthConfig, ClientConfig, ClientIdentity, OpenShellClient}; use rustls::{ RootCertStore, client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, - pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime}, + pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime, pem::PemObject}, }; use std::io::Cursor; use std::path::PathBuf; @@ -185,7 +185,9 @@ pub fn require_tls_materials(server: &str, tls: &TlsOptions) -> Result Result> { let mut cursor = Cursor::new(pem); - let key = rustls_pemfile::private_key(&mut cursor) + let key = PrivateKeyDer::pem_reader_iter(&mut cursor) + .next() + .transpose() .into_diagnostic()? .ok_or_else(|| miette::miette!("no private key found in TLS key PEM"))?; Ok(key) @@ -194,7 +196,7 @@ fn load_private_key(pem: &[u8]) -> Result> { pub fn build_rustls_config(materials: &TlsMaterials) -> Result { let mut roots = RootCertStore::empty(); let mut ca_cursor = Cursor::new(&materials.ca); - let ca_certs = rustls_pemfile::certs(&mut ca_cursor) + let ca_certs = CertificateDer::pem_reader_iter(&mut ca_cursor) .collect::>, _>>() .into_diagnostic()?; for cert in ca_certs { @@ -202,7 +204,7 @@ pub fn build_rustls_config(materials: &TlsMaterials) -> Result>, _>>() .into_diagnostic()?; let key = load_private_key(&materials.key)?; diff --git a/crates/openshell-core/Cargo.toml b/crates/openshell-core/Cargo.toml index 137744363d..c5402e5fff 100644 --- a/crates/openshell-core/Cargo.toml +++ b/crates/openshell-core/Cargo.toml @@ -33,7 +33,6 @@ url = { workspace = true } uuid = { workspace = true } ipnet = "2" rustls = { workspace = true } -rustls-pemfile = { workspace = true } base64 = { workspace = true } jsonwebtoken = { workspace = true, optional = true } zeroize = { workspace = true, optional = true } diff --git a/crates/openshell-core/src/driver_utils.rs b/crates/openshell-core/src/driver_utils.rs index 32c1ead05c..5a04659a9f 100644 --- a/crates/openshell-core/src/driver_utils.rs +++ b/crates/openshell-core/src/driver_utils.rs @@ -3,6 +3,7 @@ //! Utility helpers shared across compute-driver crates. +use rustls::pki_types::{CertificateDer, pem::PemObject}; use std::path::{Path, PathBuf}; use crate::proto::compute::v1::DriverSandbox; @@ -473,7 +474,7 @@ pub fn read_upstream_proxy_ca_bundle_file(path: &str, label: &str) -> Result Result<(), String> { - let certs: Vec<_> = rustls_pemfile::certs(&mut pem.as_bytes()) + let certs: Vec<_> = CertificateDer::pem_reader_iter(&mut pem.as_bytes()) .flatten() .collect(); if certs.is_empty() { @@ -1318,7 +1319,7 @@ mod tests { #[test] fn ca_bundle_rejects_pem_blocks_holding_invalid_der() { - // Passes `rustls_pemfile::certs` but contributes no trust anchor, so + // Passes `CertificateDer::pem_reader_iter` but contributes no trust anchor, so // accepting it on the host would break every guest after boot. let err = validate_upstream_proxy_ca_bundle_pem( "-----BEGIN CERTIFICATE-----\nAQID\n-----END CERTIFICATE-----\n", diff --git a/crates/openshell-core/src/grpc_client.rs b/crates/openshell-core/src/grpc_client.rs index 63dabaf678..209d0bddf4 100644 --- a/crates/openshell-core/src/grpc_client.rs +++ b/crates/openshell-core/src/grpc_client.rs @@ -469,7 +469,7 @@ impl Drop for ClientSpanStatus { mod gateway_tls_isolation_tests { use super::*; use rcgen::{CertificateParams, IsCa}; - use rustls::pki_types::{CertificateDer, PrivateKeyDer}; + use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use std::io::Cursor; use tokio::net::TcpListener; use tokio_rustls::TlsAcceptor; @@ -503,11 +503,13 @@ mod gateway_tls_isolation_tests { } async fn start_h2_tls_server(pki: &TestPki) -> std::net::SocketAddr { - let certificates = rustls_pemfile::certs(&mut Cursor::new(&pki.server_cert_pem)) + let certificates = CertificateDer::pem_reader_iter(&mut Cursor::new(&pki.server_cert_pem)) .collect::>, _>>() .unwrap(); let key: PrivateKeyDer<'static> = - rustls_pemfile::private_key(&mut Cursor::new(&pki.server_key_pem)) + PrivateKeyDer::pem_reader_iter(&mut Cursor::new(&pki.server_key_pem)) + .next() + .transpose() .unwrap() .unwrap(); let mut config = rustls::ServerConfig::builder() diff --git a/crates/openshell-crypto/README.md b/crates/openshell-crypto/README.md index 183b95b4b4..2167c5b913 100644 --- a/crates/openshell-crypto/README.md +++ b/crates/openshell-crypto/README.md @@ -110,7 +110,8 @@ rotation constraints still apply. Authentication failures expose no plaintext or distinction between wrong keys, AAD, nonce, ciphertext, or tags. Coverage excludes dependency-owned SSH/russh primitives, AWS SigV4 signing, -SPIFFE RustCrypto verification, and non-Rust client runtimes. AWS SDK HTTPS also +SPIFFE JWT verification, and non-Rust client runtimes. SPIFFE uses its AWS-LC +backend directly, outside the facade. AWS SDK HTTPS also retains its dependency-owned selection. Non-security content hashes and ordinary scheduling randomness are not migrated. No SSH or PQC capability is asserted by the primitive capability report. OpenSSL, strict policy, module version discovery, diff --git a/crates/openshell-driver-vm/Cargo.toml b/crates/openshell-driver-vm/Cargo.toml index 6a757e40cb..73fc3d365c 100644 --- a/crates/openshell-driver-vm/Cargo.toml +++ b/crates/openshell-driver-vm/Cargo.toml @@ -61,7 +61,7 @@ libloading = { version = "0.8", optional = true } tar = { version = "0.4", optional = true } flate2 = { version = "1", optional = true } sha2 = { version = "0.10", optional = true } -zstd = { version = "0.13", optional = true } +zstd = { version = "0.14.3", optional = true } [features] # Portable test instrumentation, independent of the compute runtime. diff --git a/crates/openshell-driver-vm/src/driver.rs b/crates/openshell-driver-vm/src/driver.rs index 72991d7204..304c95bc32 100644 --- a/crates/openshell-driver-vm/src/driver.rs +++ b/crates/openshell-driver-vm/src/driver.rs @@ -12343,6 +12343,28 @@ mod tests { let _ = fs::remove_dir_all(base); } + #[test] + fn extracts_zstd_compressed_oci_layer() { + let temp = tempfile::tempdir().unwrap(); + let archive = tar_bytes_with_file("bin/tool", b"tool contents"); + let compressed = zstd::encode_all(archive.as_slice(), 0).unwrap(); + let blob = temp.path().join("layer.tar.zst"); + let extracted = temp.path().join("extracted"); + fs::write(&blob, compressed).unwrap(); + + extract_layer_blob_to_dir( + &blob, + "application/vnd.oci.image.layer.v1.tar+zstd", + &extracted, + ) + .unwrap(); + + assert_eq!( + fs::read(extracted.join("bin/tool")).unwrap(), + b"tool contents" + ); + } + #[test] fn layer_compression_from_media_type_supports_common_formats() { assert_eq!( diff --git a/crates/openshell-sandbox-backend/Cargo.toml b/crates/openshell-sandbox-backend/Cargo.toml index 22e0868f26..8e8ff7cb05 100644 --- a/crates/openshell-sandbox-backend/Cargo.toml +++ b/crates/openshell-sandbox-backend/Cargo.toml @@ -24,7 +24,6 @@ prost = { workspace = true } prost-types = { workspace = true } rcgen = { workspace = true } rustls = { workspace = true } -rustls-pemfile = { workspace = true } serde = { workspace = true } serde_json = { workspace = true } socket2 = { workspace = true } diff --git a/crates/openshell-sandbox-backend/src/runtime.rs b/crates/openshell-sandbox-backend/src/runtime.rs index c579a0a574..f2fd1c4ffd 100644 --- a/crates/openshell-sandbox-backend/src/runtime.rs +++ b/crates/openshell-sandbox-backend/src/runtime.rs @@ -28,6 +28,7 @@ use openshell_isolation_interface::contract::{ MediationTiming, PendingDnsQuery, PendingTcpOpen, ProviderEnvironmentInstallation, ResolvedWorkloadIdentity, SandboxContext, TcpOpenDecision, TcpOpenDenial, }; +use rustls::pki_types::{CertificateDer, pem::PemObject}; use tokio::io::{AsyncReadExt, AsyncWriteExt}; #[cfg(unix)] use tokio::net::UnixStream; @@ -658,7 +659,7 @@ pub fn validate_client_tls(tls: &SandboxTlsClientConfig) -> Result<(), BackendEr fn tls_client_config(tls: &SandboxTlsClientConfig) -> Result { openshell_crypto::tls::ensure_default_provider(); - let certificates = rustls_pemfile::certs(&mut tls.trust_anchor_pem.as_bytes()) + let certificates = CertificateDer::pem_reader_iter(&mut tls.trust_anchor_pem.as_bytes()) .collect::, _>>() .map_err(|error| { BackendError::Descriptor(format!("parse boundary TLS CA certificate: {error}")) @@ -3040,6 +3041,7 @@ mod tests { mod protocol_errors; use crate::isolation_protocol::exchange_frame; + use rustls::pki_types::PrivateKeyDer; use std::path::PathBuf; use std::pin::Pin; use std::task::{Context, Poll}; @@ -4166,10 +4168,13 @@ mod tests { openshell_crypto::tls::ensure_default_provider(); let material = generate_sandbox_tls_material(test_session_id()).expect("generate test material"); - let certificates = rustls_pemfile::certs(&mut material.certificate_chain_pem.as_bytes()) - .collect::, _>>() - .expect("parse server certificate"); - let private_key = rustls_pemfile::private_key(&mut material.private_key_pem.as_bytes()) + let certificates = + CertificateDer::pem_reader_iter(&mut material.certificate_chain_pem.as_bytes()) + .collect::, _>>() + .expect("parse server certificate"); + let private_key = PrivateKeyDer::pem_reader_iter(&mut material.private_key_pem.as_bytes()) + .next() + .transpose() .expect("parse server private key") .expect("server private key"); let mut server_config = diff --git a/crates/openshell-sandbox-backend/src/runtime/test_support.rs b/crates/openshell-sandbox-backend/src/runtime/test_support.rs index 79c2ae1870..79c36e2959 100644 --- a/crates/openshell-sandbox-backend/src/runtime/test_support.rs +++ b/crates/openshell-sandbox-backend/src/runtime/test_support.rs @@ -21,6 +21,7 @@ use openshell_isolation_interface::contract::{ ProviderEnvironmentInstallation, ProvisioningEvidence, ResolvedWorkloadIdentity, SandboxContext, TcpOpenDecision, }; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use std::collections::HashMap; use std::pin::Pin; use std::sync::{Arc, Mutex}; @@ -688,10 +689,12 @@ impl super::BoundaryTransportConnector for Connector { fn client(peer: Peer) -> Arc { let session_id = "550e8400-e29b-41d4-a716-446655440000".parse().unwrap(); let material = w::generate_sandbox_tls_material(session_id).unwrap(); - let certs = rustls_pemfile::certs(&mut material.certificate_chain_pem.as_bytes()) + let certs = CertificateDer::pem_reader_iter(&mut material.certificate_chain_pem.as_bytes()) .collect::, _>>() .unwrap(); - let key = rustls_pemfile::private_key(&mut material.private_key_pem.as_bytes()) + let key = PrivateKeyDer::pem_reader_iter(&mut material.private_key_pem.as_bytes()) + .next() + .transpose() .unwrap() .unwrap(); let mut config = openshell_crypto::tls::server_builder() diff --git a/crates/openshell-sandbox-backend/src/runtime_routed.rs b/crates/openshell-sandbox-backend/src/runtime_routed.rs index 8f238ebfd2..41d75f2a79 100644 --- a/crates/openshell-sandbox-backend/src/runtime_routed.rs +++ b/crates/openshell-sandbox-backend/src/runtime_routed.rs @@ -582,6 +582,7 @@ async fn send_reply( mod tests { use super::*; use crate::boundary_protocol::{SandboxTlsMaterial, generate_sandbox_tls_material}; + use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; /// A runtime: dial the router, name `route`, and serve `identity`'s TLS. async fn runtime_dial( @@ -614,10 +615,12 @@ mod tests { .unwrap() .with_no_client_auth() .with_single_cert( - rustls_pemfile::certs(&mut identity.certificate_chain_pem.as_bytes()) + CertificateDer::pem_reader_iter(&mut identity.certificate_chain_pem.as_bytes()) .collect::, _>>() .unwrap(), - rustls_pemfile::private_key(&mut identity.private_key_pem.as_bytes()) + PrivateKeyDer::pem_reader_iter(&mut identity.private_key_pem.as_bytes()) + .next() + .transpose() .unwrap() .unwrap(), ) diff --git a/crates/openshell-sandbox/Cargo.toml b/crates/openshell-sandbox/Cargo.toml index 88f3380580..5d2cfdeb67 100644 --- a/crates/openshell-sandbox/Cargo.toml +++ b/crates/openshell-sandbox/Cargo.toml @@ -55,7 +55,6 @@ nix = { workspace = true, features = ["resource", "socket", "feature", "poll"] } # TLS crypto provider install (main.rs) rustls = { workspace = true } -rustls-pemfile = { workspace = true } tokio-rustls = { workspace = true } # Serialization (serde_json::json! for OCSF unmapped fields) diff --git a/crates/openshell-sandbox/src/boundary_server.rs b/crates/openshell-sandbox/src/boundary_server.rs index 4d014a3100..cee485a2a7 100644 --- a/crates/openshell-sandbox/src/boundary_server.rs +++ b/crates/openshell-sandbox/src/boundary_server.rs @@ -17,6 +17,7 @@ mod linux { BoundaryExec, BoundaryLoopbackConnector, BoundaryProcess, BoundaryTerminal, ExecSession, }; + use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use std::fs::File; use std::io::{self, Read, Write}; use std::mem::size_of; @@ -5034,8 +5035,9 @@ mod linux { ) -> io::Result { openshell_crypto::tls::ensure_default_provider(); let certificate_bytes = std::fs::read(&tls.certificate_chain_path)?; - let certificates = rustls_pemfile::certs(&mut certificate_bytes.as_slice()) - .collect::, _>>()?; + let certificates = CertificateDer::pem_reader_iter(&mut certificate_bytes.as_slice()) + .collect::, _>>() + .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?; if certificates.is_empty() { return Err(io::Error::new( io::ErrorKind::InvalidInput, @@ -5043,7 +5045,10 @@ mod linux { )); } let private_key_bytes = std::fs::read(&tls.private_key_path)?; - let private_key = rustls_pemfile::private_key(&mut private_key_bytes.as_slice())? + let private_key = PrivateKeyDer::pem_reader_iter(&mut private_key_bytes.as_slice()) + .next() + .transpose() + .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))? .ok_or_else(|| { io::Error::new( io::ErrorKind::InvalidInput, @@ -5558,7 +5563,8 @@ mod linux { fn test_client_config(tls: &SandboxTlsClientConfig) -> rustls::ClientConfig { let mut roots = rustls::RootCertStore::empty(); - for certificate in rustls_pemfile::certs(&mut tls.trust_anchor_pem.as_bytes()) { + for certificate in CertificateDer::pem_reader_iter(&mut tls.trust_anchor_pem.as_bytes()) + { roots .add(certificate.expect("parse test CA")) .expect("add test CA"); diff --git a/crates/openshell-server/Cargo.toml b/crates/openshell-server/Cargo.toml index f3e304a995..3ad94fa374 100644 --- a/crates/openshell-server/Cargo.toml +++ b/crates/openshell-server/Cargo.toml @@ -59,7 +59,6 @@ http-body-util = { workspace = true } # TLS tokio-rustls = { workspace = true } rustls = { workspace = true } -rustls-pemfile = { workspace = true } # CLI clap = { workspace = true } diff --git a/crates/openshell-server/src/auth/sandbox_jwt.rs b/crates/openshell-server/src/auth/sandbox_jwt.rs index 7b44633e5c..778936ec8f 100644 --- a/crates/openshell-server/src/auth/sandbox_jwt.rs +++ b/crates/openshell-server/src/auth/sandbox_jwt.rs @@ -24,10 +24,10 @@ pub use openshell_extension_core::{ EXTENSION_JWT_TYP, ExtensionAudience, ExtensionCallerKind, ExtensionJwtClaims, MAX_EXTENSION_TOKEN_TTL, }; +use rustls::pki_types::pem::{PemObject, SectionKind}; use serde::Serialize; use sha2::{Digest as _, Sha256}; use std::{ - io::Cursor, sync::Arc, time::{Duration, SystemTime, UNIX_EPOCH}, }; @@ -534,9 +534,11 @@ impl ExtensionJwtIssuer { impl GatewayJwks { fn from_public_key_pem(public_key_pem: &[u8], kid: String) -> Result { - let item = rustls_pemfile::read_one(&mut Cursor::new(public_key_pem)) + let item = <(SectionKind, Vec)>::pem_slice_iter(public_key_pem) + .next() + .transpose() .map_err(|e| format!("failed to parse Ed25519 public key PEM for JWKS: {e}"))?; - let Some(rustls_pemfile::Item::SubjectPublicKeyInfo(der)) = item else { + let Some((SectionKind::PublicKey, der)) = item else { return Err("Ed25519 public key PEM does not contain a PUBLIC KEY block".into()); }; let (remainder, spki) = SubjectPublicKeyInfo::from_der(der.as_ref()) diff --git a/crates/openshell-server/src/config_file.rs b/crates/openshell-server/src/config_file.rs index 5c4eedf9ac..cee598a992 100644 --- a/crates/openshell-server/src/config_file.rs +++ b/crates/openshell-server/src/config_file.rs @@ -21,7 +21,7 @@ use std::collections::BTreeMap; use std::fs::OpenOptions; -use std::io::{Cursor, Read as _}; +use std::io::Read as _; use std::net::SocketAddr; use std::path::{Path, PathBuf}; @@ -33,6 +33,7 @@ use openshell_core::{ ExtensionBindingPolicy, GatewayAuthConfig, GatewayInterceptorConfig, GatewayJwtConfig, GatewayProviderProfileSourceConfig, MtlsAuthConfig, OidcConfig, }; +use rustls::pki_types::pem::{PemObject, SectionKind}; use serde::{Deserialize, Serialize}; /// Gateway configuration schema version supported by this build. @@ -672,13 +673,13 @@ impl TryFrom<&MiddlewareServiceFileConfig> for SupervisorMiddlewareService { fn sanitize_ca_cert_pem(name: &str, path: &Path, pem: &[u8]) -> Result, ConfigFileError> { let mut sanitized = Vec::new(); let mut certificate_count = 0; - for item in rustls_pemfile::read_all(&mut Cursor::new(pem)) { + for item in <(SectionKind, Vec)>::pem_slice_iter(pem) { let item = item.map_err(|source| ConfigFileError::MiddlewareTlsCaInvalid { name: name.to_string(), path: path.to_path_buf(), message: source.to_string(), })?; - let rustls_pemfile::Item::X509Certificate(certificate) = item else { + let (SectionKind::Certificate, certificate) = item else { return Err(ConfigFileError::MiddlewareTlsCaInvalid { name: name.to_string(), path: path.to_path_buf(), @@ -687,7 +688,7 @@ fn sanitize_ca_cert_pem(name: &str, path: &Path, pem: &[u8]) -> Result, }; certificate_count += 1; sanitized.extend_from_slice(b"-----BEGIN CERTIFICATE-----\n"); - let encoded = base64::engine::general_purpose::STANDARD.encode(certificate.as_ref()); + let encoded = base64::engine::general_purpose::STANDARD.encode(&certificate); for line in encoded.as_bytes().chunks(64) { sanitized.extend_from_slice(line); sanitized.push(b'\n'); diff --git a/crates/openshell-server/src/network_trust.rs b/crates/openshell-server/src/network_trust.rs index 90e42be594..3dcc4f745c 100644 --- a/crates/openshell-server/src/network_trust.rs +++ b/crates/openshell-server/src/network_trust.rs @@ -11,9 +11,13 @@ use base64::Engine as _; use openshell_core::network_trust::MAX_NETWORK_SUPERVISOR_TRUST_BUNDLE_BYTES; use openshell_core::{Error, NetworkSupervisorTrustBundle, Result}; +use rustls::pki_types::{ + CertificateDer, + pem::{PemObject, SectionKind}, +}; use sha2::{Digest, Sha256}; use std::fs; -use std::io::{Cursor, ErrorKind, Read, Write}; +use std::io::{ErrorKind, Read, Write}; use std::path::{Path, PathBuf}; use crate::config_file::SupervisorNetworkFileSection; @@ -166,7 +170,7 @@ fn stage_normalized_in( } fn normalize_source(source_path: &Path, source: &[u8]) -> Result<(Vec, usize)> { - // `rustls_pemfile` intentionally skips text outside PEM blocks. The + // Rustls's PEM parser intentionally skips text outside PEM blocks. The // gateway contract is stricter: a configured file must not contain a // valid subset hidden among unrelated or malformed material. if source @@ -177,20 +181,20 @@ fn normalize_source(source_path: &Path, source: &[u8]) -> Result<(Vec, usize } let mut certificates = Vec::new(); - for item in rustls_pemfile::read_all(&mut Cursor::new(source)) { + for item in <(SectionKind, Vec)>::pem_slice_iter(source) { let item = item.map_err(|error| { config_error( source_path, format_args!("contains malformed PEM data: {error}"), ) })?; - let rustls_pemfile::Item::X509Certificate(certificate) = item else { + let (SectionKind::Certificate, certificate) = item else { return Err(config_error( source_path, "contains a non-certificate PEM block", )); }; - certificates.push(certificate); + certificates.push(CertificateDer::from(certificate)); } if certificates.is_empty() { diff --git a/crates/openshell-server/src/tls.rs b/crates/openshell-server/src/tls.rs index 26bcb713ce..d7a834ce10 100644 --- a/crates/openshell-server/src/tls.rs +++ b/crates/openshell-server/src/tls.rs @@ -16,7 +16,7 @@ use notify::{Event, RecursiveMode, Watcher}; use openshell_core::{Error, Result}; use openshell_ocsf::{ConfigStateChangeBuilder, EventContext, SeverityId, StateId, StatusId}; use rustls::ServerConfig; -use rustls::pki_types::{CertificateDer, PrivateKeyDer}; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use rustls::server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier}; use rustls::sign::CertifiedKey; use tokio::sync::{mpsc, watch}; @@ -440,7 +440,7 @@ fn load_certs(path: &Path) -> Result>> { File::open(path).map_err(|e| Error::tls(format!("failed to open cert file: {e}")))?; let mut reader = BufReader::new(file); - let certs: Vec<_> = rustls_pemfile::certs(&mut reader) + let certs: Vec<_> = CertificateDer::pem_reader_iter(&mut reader) .collect::, _>>() .map_err(|e| Error::tls(format!("failed to parse certificates: {e}")))?; @@ -456,20 +456,11 @@ fn load_key(path: &Path) -> Result> { let file = File::open(path).map_err(|e| Error::tls(format!("failed to open key file: {e}")))?; let mut reader = BufReader::new(file); - loop { - let item = rustls_pemfile::read_one(&mut reader) - .map_err(|e| Error::tls(format!("failed to parse key file: {e}")))?; - - match item { - Some(rustls_pemfile::Item::Pkcs1Key(key)) => return Ok(key.into()), - Some(rustls_pemfile::Item::Pkcs8Key(key)) => return Ok(key.into()), - Some(rustls_pemfile::Item::Sec1Key(key)) => return Ok(key.into()), - None => break, - _ => {} - } - } - - Err(Error::tls("no private key found in file")) + PrivateKeyDer::pem_reader_iter(&mut reader) + .next() + .transpose() + .map_err(|e| Error::tls(format!("failed to parse key file: {e}")))? + .ok_or_else(|| Error::tls("no private key found in file")) } /// Build an OCSF context for gateway-level (non-sandbox) events. diff --git a/crates/openshell-server/tests/common/mod.rs b/crates/openshell-server/tests/common/mod.rs index a4072b57b4..dd91664d39 100644 --- a/crates/openshell-server/tests/common/mod.rs +++ b/crates/openshell-server/tests/common/mod.rs @@ -32,8 +32,7 @@ use openshell_core::proto::{ use openshell_server::{MultiplexedService, Store, TlsAcceptor, health_router}; use rcgen::{CertificateParams, IsCa}; use rustls::RootCertStore; -use rustls::pki_types::CertificateDer; -use rustls_pemfile::certs; +use rustls::pki_types::{CertificateDer, pem::PemObject}; use std::io::Write; use std::net::SocketAddr; use std::sync::Arc; @@ -871,7 +870,7 @@ pub async fn test_health_store() -> Arc { pub fn build_tls_root(cert_pem: &[u8]) -> RootCertStore { let mut roots = RootCertStore::empty(); let mut cursor = std::io::Cursor::new(cert_pem); - let parsed = certs(&mut cursor) + let parsed = CertificateDer::pem_reader_iter(&mut cursor) .collect::>, _>>() .expect("failed to parse cert pem"); for cert in parsed { diff --git a/crates/openshell-server/tests/edge_tunnel_auth.rs b/crates/openshell-server/tests/edge_tunnel_auth.rs index df027b653b..c2463675df 100644 --- a/crates/openshell-server/tests/edge_tunnel_auth.rs +++ b/crates/openshell-server/tests/edge_tunnel_auth.rs @@ -37,8 +37,7 @@ use hyper_rustls::HttpsConnectorBuilder; use hyper_util::{client::legacy::Client, rt::TokioExecutor}; use openshell_core::proto::{HealthRequest, ServiceStatus, open_shell_client::OpenShellClient}; use openshell_server::TlsAcceptor; -use rustls::pki_types::CertificateDer; -use rustls_pemfile::certs; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use tonic::Status; use tonic::transport::{Channel, ClientTlsConfig, Endpoint}; @@ -112,13 +111,15 @@ fn https_client_mtls( let roots = build_tls_root(&pki.ca_cert_pem); let client_certs = { let mut cursor = std::io::Cursor::new(&pki.client_cert_pem); - certs(&mut cursor) + CertificateDer::pem_reader_iter(&mut cursor) .collect::>, _>>() .expect("failed to parse client cert pem") }; let client_key = { let mut cursor = std::io::Cursor::new(&pki.client_key_pem); - rustls_pemfile::private_key(&mut cursor) + PrivateKeyDer::pem_reader_iter(&mut cursor) + .next() + .transpose() .expect("failed to parse client key pem") .expect("no private key found") }; diff --git a/crates/openshell-server/tests/multiplex_tls_integration.rs b/crates/openshell-server/tests/multiplex_tls_integration.rs index c61a3be83a..11c6567520 100644 --- a/crates/openshell-server/tests/multiplex_tls_integration.rs +++ b/crates/openshell-server/tests/multiplex_tls_integration.rs @@ -14,8 +14,7 @@ use hyper::StatusCode; use hyper_rustls::HttpsConnectorBuilder; use hyper_util::{client::legacy::Client, rt::TokioExecutor}; use openshell_core::proto::{HealthRequest, ServiceStatus, open_shell_client::OpenShellClient}; -use rustls::pki_types::CertificateDer; -use rustls_pemfile::certs; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use tonic::transport::{ClientTlsConfig, Endpoint}; /// Build an HTTPS client with mTLS (CA trust + client cert/key). @@ -29,13 +28,15 @@ fn https_client_mtls( let client_certs = { let mut cursor = std::io::Cursor::new(&pki.client_cert_pem); - certs(&mut cursor) + CertificateDer::pem_reader_iter(&mut cursor) .collect::>, _>>() .expect("failed to parse client cert pem") }; let client_key = { let mut cursor = std::io::Cursor::new(&pki.client_key_pem); - rustls_pemfile::private_key(&mut cursor) + PrivateKeyDer::pem_reader_iter(&mut cursor) + .next() + .transpose() .expect("failed to parse client key pem") .expect("no private key found") }; diff --git a/crates/openshell-server/tests/spiffe_jwt.rs b/crates/openshell-server/tests/spiffe_jwt.rs new file mode 100644 index 0000000000..1da64569dc --- /dev/null +++ b/crates/openshell-server/tests/spiffe_jwt.rs @@ -0,0 +1,64 @@ +// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::time::{SystemTime, UNIX_EPOCH}; + +use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD}; +use jsonwebtoken::{Algorithm, EncodingKey, Header}; +use rcgen::PublicKeyData as _; +use serde_json::json; +use spiffe::{JwtBundle, JwtBundleSet, JwtSvid, TrustDomain}; + +#[test] +fn spiffe_verifies_signed_jwt_svids_with_the_selected_crypto_backend() { + let key = openshell_crypto::pki::generate_keypair().unwrap(); + let public_key = key.der_bytes(); + let jwks = json!({ + "keys": [{ + "kty": "EC", + "kid": "test-key", + "crv": "P-256", + "x": URL_SAFE_NO_PAD.encode(&public_key[1..33]), + "y": URL_SAFE_NO_PAD.encode(&public_key[33..65]), + }], + }); + let mut bundles = JwtBundleSet::new(); + bundles.add_bundle( + JwtBundle::from_jwt_authorities( + TrustDomain::new("example.org").unwrap(), + &serde_json::to_vec(&jwks).unwrap(), + ) + .unwrap(), + ); + + let mut header = Header::new(Algorithm::ES256); + header.kid = Some("test-key".into()); + let now = SystemTime::now() + .duration_since(UNIX_EPOCH) + .unwrap() + .as_secs(); + let mut claims = json!({ + "sub": "spiffe://example.org/supervisor", + "aud": ["openshell"], + "exp": now + 300, + }); + let signing_key = EncodingKey::from_ec_pem(key.serialize_pem().unwrap().as_bytes()).unwrap(); + let token = openshell_crypto::jwt::encode(&header, &claims, &signing_key).unwrap(); + + let svid = JwtSvid::parse_and_validate(&token, &bundles, &["openshell"]).unwrap(); + assert_eq!( + svid.spiffe_id().to_string(), + "spiffe://example.org/supervisor" + ); + assert!(JwtSvid::parse_and_validate(&token, &bundles, &["another-audience"]).is_err()); + + let untrusted_key = openshell_crypto::pki::generate_keypair().unwrap(); + let untrusted_key = + EncodingKey::from_ec_pem(untrusted_key.serialize_pem().unwrap().as_bytes()).unwrap(); + let forged = openshell_crypto::jwt::encode(&header, &claims, &untrusted_key).unwrap(); + assert!(JwtSvid::parse_and_validate(&forged, &bundles, &["openshell"]).is_err()); + + claims["exp"] = json!(now - 300); + let expired = openshell_crypto::jwt::encode(&header, &claims, &signing_key).unwrap(); + assert!(JwtSvid::parse_and_validate(&expired, &bundles, &["openshell"]).is_err()); +} diff --git a/crates/openshell-supervisor-network/Cargo.toml b/crates/openshell-supervisor-network/Cargo.toml index d2ad9901da..aa3ca35014 100644 --- a/crates/openshell-supervisor-network/Cargo.toml +++ b/crates/openshell-supervisor-network/Cargo.toml @@ -44,7 +44,6 @@ regorus = { version = "0.9", default-features = false, features = ["std", "arc", reqwest = { workspace = true } rustls = { workspace = true } rustls-native-certs = { workspace = true } -rustls-pemfile = { workspace = true } serde = { workspace = true } serde_json = { workspace = true } serde_yml = { workspace = true } diff --git a/crates/openshell-supervisor-network/src/l7/tls.rs b/crates/openshell-supervisor-network/src/l7/tls.rs index fe24afc90d..5cb6166e96 100644 --- a/crates/openshell-supervisor-network/src/l7/tls.rs +++ b/crates/openshell-supervisor-network/src/l7/tls.rs @@ -12,7 +12,7 @@ use miette::{IntoDiagnostic, Result, WrapErr, miette}; use openshell_crypto::pki::KeyPair; use rcgen::{CertificateParams, DnType, IsCa, KeyUsagePurpose}; use rustls::ClientConfig; -use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName}; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName, pem::PemObject}; use std::collections::HashMap; use std::io::{BufReader, Write as _}; use std::path::{Path, PathBuf}; @@ -105,7 +105,7 @@ impl SandboxCa { let ca_key = KeyPair::from_pem(private_key_pem) .into_diagnostic() .wrap_err("parse proxy CA private key")?; - let certificates = rustls_pemfile::certs(&mut certificate_pem.as_bytes()) + let certificates = CertificateDer::pem_reader_iter(&mut certificate_pem.as_bytes()) .collect::, _>>() .into_diagnostic() .wrap_err("parse proxy CA certificate")?; @@ -114,7 +114,9 @@ impl SandboxCa { "proxy CA certificate file must contain exactly one certificate" )); } - let private_key = rustls_pemfile::private_key(&mut private_key_pem.as_bytes()) + let private_key = PrivateKeyDer::pem_reader_iter(&mut private_key_pem.as_bytes()) + .next() + .transpose() .into_diagnostic() .wrap_err("parse proxy CA private key")? .ok_or_else(|| miette!("proxy CA private key file contains no private key"))?; @@ -428,10 +430,9 @@ fn load_pem_certs_into_store( return (0, 0); } let mut reader = BufReader::new(pem_data.as_bytes()); - // Collect all results so we can count PEM blocks that fail base64 - // decoding — rustls_pemfile::certs silently drops those, so without - // this they wouldn't be reflected in the `ignored` count. - let all_results: Vec<_> = rustls_pemfile::certs(&mut reader).collect(); + // Count PEM decoding errors before filtering them out so they contribute + // to the `ignored` count alongside certificates rejected by the root store. + let all_results: Vec<_> = CertificateDer::pem_reader_iter(&mut reader).collect(); let pem_errors = all_results.iter().filter(|r| r.is_err()).count(); let certs: Vec> = all_results.into_iter().filter_map(Result::ok).collect(); @@ -460,7 +461,7 @@ pub fn read_system_ca_bundle() -> String { pub fn parse_pem_certs(path: &Path) -> Result>> { let file = std::fs::File::open(path).into_diagnostic()?; let mut reader = BufReader::new(file); - rustls_pemfile::certs(&mut reader) + CertificateDer::pem_reader_iter(&mut reader) .collect::, _>>() .into_diagnostic() } @@ -736,7 +737,7 @@ mod tests { // Bundle should be parseable as PEM certificates let mut reader = BufReader::new(bundle_pem.as_bytes()); assert!( - rustls_pemfile::certs(&mut reader).any(|r| r.is_ok()), + CertificateDer::pem_reader_iter(&mut reader).any(|r| r.is_ok()), "bundle should contain at least one cert", ); } @@ -772,7 +773,7 @@ mod tests { assert_eq!(loaded.cert_pem(), certificate); assert_eq!(loaded.private_key_pem().unwrap(), private_key); - let original_der = rustls_pemfile::certs(&mut certificate.as_bytes()) + let original_der = CertificateDer::pem_reader_iter(&mut certificate.as_bytes()) .next() .unwrap() .unwrap(); diff --git a/crates/openshell-supervisor-network/src/proxy/relay.rs b/crates/openshell-supervisor-network/src/proxy/relay.rs index 3e722e3b50..495c22241b 100644 --- a/crates/openshell-supervisor-network/src/proxy/relay.rs +++ b/crates/openshell-supervisor-network/src/proxy/relay.rs @@ -471,9 +471,10 @@ mod tests { #[tokio::test] async fn tls_http_relay_reuses_then_sends_close_notify_after_complete_response() { use crate::l7::tls::{CertCache, ProxyTlsState, SandboxCa, tls_terminate_client}; + use rustls::pki_types::{CertificateDer, pem::PemObject}; let ca = SandboxCa::generate().unwrap(); let mut roots = rustls::RootCertStore::empty(); - for cert in rustls_pemfile::certs(&mut ca.cert_pem().as_bytes()) { + for cert in CertificateDer::pem_reader_iter(&mut ca.cert_pem().as_bytes()) { roots.add(cert.unwrap()).unwrap(); } let config = Arc::new( diff --git a/deny.toml b/deny.toml index 7d6c8929eb..4950c33797 100644 --- a/deny.toml +++ b/deny.toml @@ -14,20 +14,7 @@ yanked = "warn" unmaintained = "workspace" maximum-db-staleness = "P30D" ignore = [ - # Pre-existing advisories acknowledged at onboarding. Each should be - # resolved by upgrading the affected transitive dependency and then - # removing the ignore entry. - { id = "RUSTSEC-2026-0190", reason = "anyhow unsoundness in downcast_mut — awaiting upstream fix" }, - { id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" }, - { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" }, - { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" }, - # SPIFFE's jsonwebtoken RustCrypto stack still requires crypto-bigint 0.5. - # Remove after compatible upstream releases include the dependency upgrade: - # https://github.com/Keats/jsonwebtoken/pull/536 - { id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 timing variability — transitive via SPIFFE/jsonwebtoken; remove when the dependency chain supports crypto-bigint >=0.7.6" }, - { id = "RUSTSEC-2026-0391", reason = "zstd context reuse leaks prior stream data — VM driver and zip create fresh contexts; remove when the dependency chain supports zstd >=0.14.3" }, - { id = "RUSTSEC-2026-0398", reason = "zstd-safe seekable decompression memory corruption — current consumers do not use the seekable API; remove when the dependency chain supports zstd-safe >=8.2.0" }, - { id = "RUSTSEC-2026-0403", reason = "zstd-safe legacy frame error leaks uninitialized memory through write decoders — VM driver and zip use read decoders; remove when the dependency chain supports zstd-safe >=8.2.0" }, + { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — required by russh/ssh-key and RSA test fixtures; no patched release is available" }, ] # -- Licenses ------------------------------------------------------------------ diff --git a/e2e/rust/Cargo.lock b/e2e/rust/Cargo.lock index 8c7bd49edb..9f585578ce 100644 --- a/e2e/rust/Cargo.lock +++ b/e2e/rust/Cargo.lock @@ -2039,7 +2039,6 @@ dependencies = [ "prost", "rand 0.9.5", "rustls", - "rustls-pemfile", "serde", "serde_json", "serial_test", @@ -2638,15 +2637,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.15.1" diff --git a/e2e/rust/Cargo.toml b/e2e/rust/Cargo.toml index 802339aed0..b40b170996 100644 --- a/e2e/rust/Cargo.toml +++ b/e2e/rust/Cargo.toml @@ -290,7 +290,6 @@ sha2 = "0.10" hex = "0.4" rand = "0.9" rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12"] } -rustls-pemfile = "2" serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yml = { package = "noyalib", version = "0.0.53", default-features = false, features = ["std", "compat-serde-yaml"] } diff --git a/e2e/rust/tests/service_bearer_passthrough.rs b/e2e/rust/tests/service_bearer_passthrough.rs index 088607e1de..aa64432802 100644 --- a/e2e/rust/tests/service_bearer_passthrough.rs +++ b/e2e/rust/tests/service_bearer_passthrough.rs @@ -22,7 +22,7 @@ use hyper_util::rt::TokioIo; use openshell_e2e::harness::binary::openshell_cmd; use openshell_e2e::harness::sandbox::{E2E_WORKLOAD_IMAGE, SandboxGuard}; use rustls::RootCertStore; -use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName}; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName, pem::PemObject}; use serde_json::Value; use tokio::io::{AsyncRead, AsyncWrite}; use tokio::net::TcpStream; @@ -32,7 +32,7 @@ use url::Position; const SERVICE_PORT: &str = "4500"; const BEARER_TOKEN: &str = "Bearer openshell-e2e-application-token"; -const READY_TIMEOUT: Duration = Duration::from_secs(60); +const READY_TIMEOUT: Duration = Duration::from_mins(1); const HEADER_ECHO_SERVER: &str = r#" from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer @@ -129,7 +129,7 @@ fn load_certificates( let file = File::open(path) .map_err(|error| format!("open {description} '{}': {error}", path.display()))?; let mut reader = BufReader::new(file); - rustls_pemfile::certs(&mut reader) + CertificateDer::pem_reader_iter(&mut reader) .collect::, _>>() .map_err(|error| format!("parse {description} '{}': {error}", path.display())) } @@ -138,7 +138,9 @@ fn load_private_key(path: &Path) -> Result, String> { let file = File::open(path) .map_err(|error| format!("open client TLS key '{}': {error}", path.display()))?; let mut reader = BufReader::new(file); - rustls_pemfile::private_key(&mut reader) + PrivateKeyDer::pem_reader_iter(&mut reader) + .next() + .transpose() .map_err(|error| format!("parse client TLS key '{}': {error}", path.display()))? .ok_or_else(|| format!("client TLS key '{}' is empty", path.display())) } diff --git a/examples/governance-interceptor/Cargo.lock b/examples/governance-interceptor/Cargo.lock index 1f816f757f..aeacfcaf1c 100644 --- a/examples/governance-interceptor/Cargo.lock +++ b/examples/governance-interceptor/Cargo.lock @@ -1871,7 +1871,6 @@ dependencies = [ "protoc-bin-vendored", "rustix", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2308,9 +2307,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" [[package]] name = "pulldown-cmark" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags", "memchr", @@ -2509,15 +2508,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.15.1" diff --git a/examples/isolation-backend-v8/Cargo.lock b/examples/isolation-backend-v8/Cargo.lock index b86eb5a6ef..630bce0820 100644 --- a/examples/isolation-backend-v8/Cargo.lock +++ b/examples/isolation-backend-v8/Cargo.lock @@ -1656,7 +1656,6 @@ dependencies = [ "protoc-bin-vendored", "rustix 1.1.5", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2140,7 +2139,6 @@ dependencies = [ "protoc-bin-vendored", "rustix 1.1.5", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2225,7 +2223,6 @@ dependencies = [ "rcgen", "rustix 1.1.5", "rustls", - "rustls-pemfile", "serde", "serde_json", "socket2", @@ -2574,9 +2571,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags", "memchr", @@ -2789,15 +2786,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.15.1" diff --git a/examples/isolation-backend-v8/Cargo.toml b/examples/isolation-backend-v8/Cargo.toml index d67d63b2d5..4be42380a4 100644 --- a/examples/isolation-backend-v8/Cargo.toml +++ b/examples/isolation-backend-v8/Cargo.toml @@ -20,7 +20,6 @@ openshell-sandbox-backend = { path = "../../crates/openshell-sandbox-backend" } rustix = { version = "1", features = ["process"] } tokio-rustls = "0.26" rustls = "0.23" -rustls-pemfile = "2" clap = { version = "4.5", features = ["derive", "env"] } prost = "0.14" prost-types = "0.14" diff --git a/examples/isolation-backend-v8/src/lifecycle.rs b/examples/isolation-backend-v8/src/lifecycle.rs index f80a48575e..8f4d76857a 100644 --- a/examples/isolation-backend-v8/src/lifecycle.rs +++ b/examples/isolation-backend-v8/src/lifecycle.rs @@ -11,6 +11,7 @@ use anyhow::{Result, ensure}; use openshell_core::jwt::{SandboxId, SessionJwtVerifier, SessionTokenProfile, SystemJwtClock}; use openshell_isolation_interface::contract::BoundaryConfirmation; use openshell_sandbox_backend::{boundary_protocol as wire, sandbox_auth::*}; +use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject}; use sha2::{Digest, Sha256}; use std::{ collections::{HashMap, HashSet}, @@ -655,9 +656,11 @@ pub async fn serve(state_dir: PathBuf) -> Result<()> { tokio::time::sleep(Duration::from_millis(100)).await; } let launch: Launch = serde_json::from_slice(&std::fs::read(&path)?)?; - let certs = rustls_pemfile::certs(&mut launch.certificate.as_bytes()) + let certs = CertificateDer::pem_reader_iter(&mut launch.certificate.as_bytes()) .collect::, _>>()?; - let key = rustls_pemfile::private_key(&mut launch.private_key.as_bytes())? + let key = PrivateKeyDer::pem_reader_iter(&mut launch.private_key.as_bytes()) + .next() + .transpose()? .ok_or_else(|| anyhow::anyhow!("missing TLS key"))?; let mut tls = rustls::ServerConfig::builder_with_protocol_versions(&[&rustls::version::TLS13]) diff --git a/examples/supervisor-middleware-content-guard/Cargo.lock b/examples/supervisor-middleware-content-guard/Cargo.lock index 55cb89c664..c07fef5a94 100644 --- a/examples/supervisor-middleware-content-guard/Cargo.lock +++ b/examples/supervisor-middleware-content-guard/Cargo.lock @@ -2025,7 +2025,6 @@ dependencies = [ "protoc-bin-vendored", "rustix", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2430,9 +2429,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" [[package]] name = "pulldown-cmark" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags", "memchr", @@ -2631,15 +2630,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.15.1" diff --git a/tests/suites/conformance/Cargo.lock b/tests/suites/conformance/Cargo.lock index 2584442743..36896785e7 100644 --- a/tests/suites/conformance/Cargo.lock +++ b/tests/suites/conformance/Cargo.lock @@ -56,9 +56,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "asn1-rs" @@ -1911,7 +1911,6 @@ dependencies = [ "reqwest", "rustix", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2349,9 +2348,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" [[package]] name = "pulldown-cmark" -version = "0.13.3" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags", "memchr", @@ -2630,15 +2629,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.14.0" diff --git a/tests/suites/features/Cargo.lock b/tests/suites/features/Cargo.lock index e822221cf5..7e6509f278 100644 --- a/tests/suites/features/Cargo.lock +++ b/tests/suites/features/Cargo.lock @@ -1865,7 +1865,6 @@ dependencies = [ "prost", "rand 0.9.5", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha1 0.10.7", @@ -2432,15 +2431,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.15.1" diff --git a/tests/testkit/Cargo.lock b/tests/testkit/Cargo.lock index 8e14c2f944..d5af8b9233 100644 --- a/tests/testkit/Cargo.lock +++ b/tests/testkit/Cargo.lock @@ -56,9 +56,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "asn1-rs" @@ -1900,7 +1900,6 @@ dependencies = [ "reqwest", "rustix", "rustls", - "rustls-pemfile", "serde", "serde_json", "sha2 0.10.9", @@ -2330,9 +2329,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" [[package]] name = "pulldown-cmark" -version = "0.13.3" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags", "memchr", @@ -2611,15 +2610,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "rustls-pki-types" version = "1.14.0" From 9dcf456285d73c5fdef669a021c83706347197c8 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Thu, 29 Oct 2026 14:32:12 +0100 Subject: [PATCH 2/2] chore(deps): use zstd 0.14 requirement Signed-off-by: Adrien Langou --- crates/openshell-driver-vm/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/openshell-driver-vm/Cargo.toml b/crates/openshell-driver-vm/Cargo.toml index 73fc3d365c..54a24e416a 100644 --- a/crates/openshell-driver-vm/Cargo.toml +++ b/crates/openshell-driver-vm/Cargo.toml @@ -61,7 +61,7 @@ libloading = { version = "0.8", optional = true } tar = { version = "0.4", optional = true } flate2 = { version = "1", optional = true } sha2 = { version = "0.10", optional = true } -zstd = { version = "0.14.3", optional = true } +zstd = { version = "0.14", optional = true } [features] # Portable test instrumentation, independent of the compute runtime.