Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 17 Packages Wiki Activity Actions 286

sec: answer the advisory gate's first catch, remove hpke-rs 0.2.0, and clear every yanked dependency #449

Merged
dcharlot merged 4 commits from sec/unsound-bumps-2026-10 into main 2026-10-24 20:47:02 -04:00
Conversation 0 Commits 4 Files changed 13 +286 -369
13 changed files with 286 additions and 369 deletions
Download patch file Download diff file Expand all files Collapse all files

4
eoc/eoc-rs/Cargo.lock generated
View file

@ -339,9 +339,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.1" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cpufeatures", "cpufeatures",

307
joule-code/joule-code-rs/Cargo.lock generated
View file

@ -73,7 +73,7 @@ dependencies = [
"nom 7.1.3", "nom 7.1.3",
"num-traits", "num-traits",
"rusticata-macros", "rusticata-macros",
"thiserror 2.0.20", "thiserror",
"time", "time",
] ]
@ -325,9 +325,9 @@ dependencies = [
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.1" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cpufeatures 0.3.0", "cpufeatures 0.3.0",
@ -431,7 +431,7 @@ version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1" checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
dependencies = [ dependencies = [
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -621,9 +621,9 @@ dependencies = [
[[package]] [[package]]
name = "ctutils" name = "ctutils"
version = "0.4.3" version = "0.4.4"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574" checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
dependencies = [ dependencies = [
"cmov", "cmov",
] ]
@ -926,7 +926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [ dependencies = [
"libc", "libc",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -1013,7 +1013,7 @@ dependencies = [
"rand_core 0.6.4", "rand_core 0.6.4",
"serde", "serde",
"serdect", "serdect",
"thiserror 2.0.20", "thiserror",
"visibility", "visibility",
"zeroize", "zeroize",
] ]
@ -1335,45 +1335,23 @@ dependencies = [
"digest 0.11.3", "digest 0.11.3",
] ]
[[package]]
name = "hpke-rs"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e11bd4ee27b79fa1820e72ef8489cc729c87299ec3f7f52b8fc8dcb87cb2d485"
dependencies = [
"hpke-rs-crypto 0.2.0",
"log",
"serde",
"tls_codec 0.4.2",
"zeroize",
]
[[package]] [[package]]
name = "hpke-rs" name = "hpke-rs"
version = "0.7.0" version = "0.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "812de62ab573b876c6c40d7553bae9402ae3bad95b64af06f964388eecb9b7b1" checksum = "812de62ab573b876c6c40d7553bae9402ae3bad95b64af06f964388eecb9b7b1"
dependencies = [ dependencies = [
"hpke-rs-crypto 0.7.0", "hpke-rs-crypto",
"hpke-rs-libcrux", "hpke-rs-libcrux",
"hpke-rs-rust-crypto 0.7.0", "hpke-rs-rust-crypto",
"libcrux-sha3", "libcrux-sha3",
"log", "log",
"serde", "serde",
"subtle", "subtle",
"tls_codec 0.5.0", "tls_codec",
"zeroize", "zeroize",
] ]
[[package]]
name = "hpke-rs-crypto"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1c3f1ae0a26c18d6469a70db1217136056261c4a244b09a755bc60bd4e055b67"
dependencies = [
"rand_core 0.6.4",
]
[[package]] [[package]]
name = "hpke-rs-crypto" name = "hpke-rs-crypto"
version = "0.7.0" version = "0.7.0"
@ -1390,7 +1368,7 @@ version = "0.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4c1ace95ef11fbbd84527eada5fc1304f66720fc4c008db30d888d62d3c52613" checksum = "4c1ace95ef11fbbd84527eada5fc1304f66720fc4c008db30d888d62d3c52613"
dependencies = [ dependencies = [
"hpke-rs-crypto 0.7.0", "hpke-rs-crypto",
"libcrux-aead", "libcrux-aead",
"libcrux-ecdh", "libcrux-ecdh",
"libcrux-hkdf", "libcrux-hkdf",
@ -1402,24 +1380,6 @@ dependencies = [
"zeroize", "zeroize",
] ]
[[package]]
name = "hpke-rs-rust-crypto"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a08d4500baf0aced746723d3515d08212bdb9d941df6d1aca3d46d1619b2a1cf"
dependencies = [
"aes-gcm",
"chacha20poly1305",
"hkdf 0.12.4",
"hpke-rs-crypto 0.2.0",
"p256",
"p384",
"rand_chacha 0.3.1",
"rand_core 0.6.4",
"sha2 0.10.9",
"x25519-dalek 2.0.1",
]
[[package]] [[package]]
name = "hpke-rs-rust-crypto" name = "hpke-rs-rust-crypto"
version = "0.7.0" version = "0.7.0"
@ -1429,7 +1389,7 @@ dependencies = [
"aes-gcm", "aes-gcm",
"chacha20poly1305", "chacha20poly1305",
"hkdf 0.13.0", "hkdf 0.13.0",
"hpke-rs-crypto 0.7.0", "hpke-rs-crypto",
"k256", "k256",
"ml-kem", "ml-kem",
"p256", "p256",
@ -1731,7 +1691,7 @@ dependencies = [
"ed25519-dalek", "ed25519-dalek",
"jcp-schema", "jcp-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1744,7 +1704,7 @@ dependencies = [
"jcp-schema", "jcp-schema",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1766,7 +1726,7 @@ dependencies = [
"hex", "hex",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1781,7 +1741,7 @@ dependencies = [
"jni-sys", "jni-sys",
"log", "log",
"simd_cesu8", "simd_cesu8",
"thiserror 2.0.20", "thiserror",
"walkdir", "walkdir",
"windows-link", "windows-link",
] ]
@ -1835,7 +1795,7 @@ dependencies = [
"ed25519-dalek", "ed25519-dalek",
"joule-code-schema", "joule-code-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1855,11 +1815,11 @@ dependencies = [
"frost-ed25519", "frost-ed25519",
"joule-code-cargo", "joule-code-cargo",
"joule-code-schema", "joule-code-schema",
"openmls 0.6.0", "openmls",
"openmls_basic_credential", "openmls_basic_credential",
"openmls_rust_crypto 0.3.0", "openmls_rust_crypto",
"rand 0.8.8", "rand 0.8.8",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1916,7 +1876,7 @@ dependencies = [
"joule-code-schema", "joule-code-schema",
"joulecontract-receipt", "joulecontract-receipt",
"joulecontract-schema", "joulecontract-schema",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1928,7 +1888,7 @@ dependencies = [
"joule-code-schema", "joule-code-schema",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1947,7 +1907,7 @@ dependencies = [
"proof-schema", "proof-schema",
"proof-solvers", "proof-solvers",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1970,7 +1930,7 @@ dependencies = [
"sandbox-schema", "sandbox-schema",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1981,7 +1941,7 @@ dependencies = [
"joule-code-cargo", "joule-code-cargo",
"joule-code-schema", "joule-code-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -1996,7 +1956,7 @@ dependencies = [
"joule-code-spec", "joule-code-spec",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2007,7 +1967,7 @@ dependencies = [
"blake3", "blake3",
"ciborium", "ciborium",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2018,7 +1978,7 @@ dependencies = [
"joule-code-cargo", "joule-code-cargo",
"joule-code-schema", "joule-code-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2044,7 +2004,7 @@ dependencies = [
"serde", "serde",
"serde_json", "serde_json",
"sha2 0.10.9", "sha2 0.10.9",
"thiserror 2.0.20", "thiserror",
"tokio", "tokio",
"tracing", "tracing",
"uuid", "uuid",
@ -2072,7 +2032,7 @@ dependencies = [
"serde_json", "serde_json",
"sha2 0.10.9", "sha2 0.10.9",
"str0m", "str0m",
"thiserror 2.0.20", "thiserror",
"tokio", "tokio",
"toml", "toml",
"tracing", "tracing",
@ -2109,13 +2069,13 @@ dependencies = [
"getrandom 0.2.17", "getrandom 0.2.17",
"hex", "hex",
"joule-moq", "joule-moq",
"openmls 0.9.1", "openmls",
"openmls_rust_crypto 0.6.0", "openmls_rust_crypto",
"openmls_traits 0.6.0", "openmls_traits",
"serde", "serde",
"serde_json", "serde_json",
"sha2 0.10.9", "sha2 0.10.9",
"tls_codec 0.5.0", "tls_codec",
] ]
[[package]] [[package]]
@ -2136,7 +2096,7 @@ dependencies = [
"rustls", "rustls",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
"tokio", "tokio",
"tokio-tungstenite", "tokio-tungstenite",
"toml", "toml",
@ -2163,7 +2123,7 @@ version = "0.6.0"
dependencies = [ dependencies = [
"joulecontract-schema", "joulecontract-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2174,7 +2134,7 @@ dependencies = [
"proof-cascade", "proof-cascade",
"proof-schema", "proof-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2186,7 +2146,7 @@ dependencies = [
"joulecontract-seal", "joulecontract-seal",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2197,7 +2157,7 @@ dependencies = [
"serde", "serde",
"serde_json", "serde_json",
"sha2 0.10.9", "sha2 0.10.9",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2209,7 +2169,7 @@ dependencies = [
"rand 0.8.8", "rand 0.8.8",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2223,7 +2183,7 @@ dependencies = [
"joulecontract-schema", "joulecontract-schema",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -2249,7 +2209,7 @@ dependencies = [
"quinn", "quinn",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
"tokio", "tokio",
"tokio-util", "tokio-util",
"tracing", "tracing",
@ -2356,7 +2316,7 @@ dependencies = [
"libcrux-curve25519", "libcrux-curve25519",
"libcrux-p256", "libcrux-p256",
"rand 0.10.2", "rand 0.10.2",
"tls_codec 0.5.0", "tls_codec",
] ]
[[package]] [[package]]
@ -2439,7 +2399,7 @@ dependencies = [
"libcrux-sha3", "libcrux-sha3",
"libcrux-traits", "libcrux-traits",
"rand 0.10.2", "rand 0.10.2",
"tls_codec 0.5.0", "tls_codec",
] ]
[[package]] [[package]]
@ -2743,20 +2703,6 @@ version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
[[package]]
name = "openmls"
version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1f1295188c6665fb9e96466180ac0a919ef52b5861cf7e86523823661348a597"
dependencies = [
"log",
"openmls_traits 0.3.0",
"rayon",
"serde",
"thiserror 1.0.69",
"tls_codec 0.4.2",
]
[[package]] [[package]]
name = "openmls" name = "openmls"
version = "0.9.1" version = "0.9.1"
@ -2766,41 +2712,31 @@ dependencies = [
"getrandom 0.4.3", "getrandom 0.4.3",
"log", "log",
"openmls_serialization_helpers", "openmls_serialization_helpers",
"openmls_traits 0.6.0", "openmls_traits",
"rayon", "rayon",
"serde", "serde",
"serde_bytes", "serde_bytes",
"thiserror 2.0.20", "thiserror",
"tls_codec 0.5.0", "tls_codec",
"web-time", "web-time",
"zeroize", "zeroize",
] ]
[[package]] [[package]]
name = "openmls_basic_credential" name = "openmls_basic_credential"
version = "0.3.0" version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "465874276a4e2a3e391b25a464059a224c70c5c77ca1e3f595032bb310ab8984" checksum = "dbd3f0c3422e7c7a8496f042b547b0c28d0793f8ba97feb401966e58196a1e40"
dependencies = [ dependencies = [
"ed25519-dalek", "ed25519-dalek",
"openmls_traits 0.3.0", "ml-dsa",
"openmls_traits",
"p256", "p256",
"rand 0.8.8", "p384",
"rand_core 0.6.4",
"serde", "serde",
"tls_codec 0.4.2", "tls_codec",
] "zeroize",
[[package]]
name = "openmls_memory_storage"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ea9cc9eb04ed97262fa96382d7dbf0adfebd5ecde7dbafc7070f9231dd9cf08b"
dependencies = [
"log",
"openmls_traits 0.3.0",
"serde",
"serde_json",
"thiserror 1.0.69",
] ]
[[package]] [[package]]
@ -2810,35 +2746,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ce927945a16eaa19302ed5ccef052f01ba68f2ba7ae67e4ac4ff2fc661445364" checksum = "ce927945a16eaa19302ed5ccef052f01ba68f2ba7ae67e4ac4ff2fc661445364"
dependencies = [ dependencies = [
"log", "log",
"openmls_traits 0.6.0", "openmls_traits",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
]
[[package]]
name = "openmls_rust_crypto"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1038331eabb5e63f276c9f866c081167c3ec1448ece0bf2bd535d1ecb5083d39"
dependencies = [
"aes-gcm",
"chacha20poly1305",
"ed25519-dalek",
"hkdf 0.12.4",
"hmac 0.12.1",
"hpke-rs 0.2.0",
"hpke-rs-crypto 0.2.0",
"hpke-rs-rust-crypto 0.2.0",
"openmls_memory_storage 0.3.0",
"openmls_traits 0.3.0",
"p256",
"rand 0.8.8",
"rand_chacha 0.3.1",
"serde",
"sha2 0.10.9",
"thiserror 1.0.69",
"tls_codec 0.4.2",
] ]
[[package]] [[package]]
@ -2852,20 +2763,20 @@ dependencies = [
"ed25519-dalek", "ed25519-dalek",
"hkdf 0.13.0", "hkdf 0.13.0",
"hmac 0.13.0", "hmac 0.13.0",
"hpke-rs 0.7.0", "hpke-rs",
"hpke-rs-crypto 0.7.0", "hpke-rs-crypto",
"hpke-rs-rust-crypto 0.7.0", "hpke-rs-rust-crypto",
"ml-dsa", "ml-dsa",
"openmls_memory_storage 0.6.0", "openmls_memory_storage",
"openmls_traits 0.6.0", "openmls_traits",
"p256", "p256",
"p384", "p384",
"rand_chacha 0.3.1", "rand_chacha 0.3.1",
"rand_core 0.10.1", "rand_core 0.10.1",
"rand_core 0.6.4", "rand_core 0.6.4",
"sha2 0.11.1", "sha2 0.11.1",
"thiserror 2.0.20", "thiserror",
"tls_codec 0.5.0", "tls_codec",
] ]
[[package]] [[package]]
@ -2877,17 +2788,7 @@ dependencies = [
"proc-macro2", "proc-macro2",
"quote", "quote",
"syn 2.0.119", "syn 2.0.119",
"thiserror 2.0.20", "thiserror",
]
[[package]]
name = "openmls_traits"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "443afa05406adc75fbfa0c3e04db93c5647b763861a474ae1aa8a99c362b80f8"
dependencies = [
"serde",
"tls_codec 0.4.2",
] ]
[[package]] [[package]]
@ -2897,7 +2798,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac13edad8698eb1917cbc1dab99591fa1594d84320904fe3fc5121854f95831c" checksum = "ac13edad8698eb1917cbc1dab99591fa1594d84320904fe3fc5121854f95831c"
dependencies = [ dependencies = [
"serde", "serde",
"tls_codec 0.5.0", "tls_codec",
] ]
[[package]] [[package]]
@ -3126,7 +3027,7 @@ dependencies = [
"hex", "hex",
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -3151,7 +3052,7 @@ dependencies = [
"rustc-hash", "rustc-hash",
"rustls", "rustls",
"socket2", "socket2",
"thiserror 2.0.20", "thiserror",
"tokio", "tokio",
"tracing", "tracing",
"web-time", "web-time",
@ -3175,7 +3076,7 @@ dependencies = [
"rustls-pki-types", "rustls-pki-types",
"rustls-platform-verifier", "rustls-platform-verifier",
"slab", "slab",
"thiserror 2.0.20", "thiserror",
"tinyvec", "tinyvec",
"tracing", "tracing",
"web-time", "web-time",
@ -3192,7 +3093,7 @@ dependencies = [
"once_cell", "once_cell",
"socket2", "socket2",
"tracing", "tracing",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -3243,7 +3144,7 @@ version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
dependencies = [ dependencies = [
"chacha20 0.10.1", "chacha20 0.10.2",
"getrandom 0.4.3", "getrandom 0.4.3",
"rand_core 0.10.1", "rand_core 0.10.1",
] ]
@ -3479,7 +3380,7 @@ dependencies = [
"security-framework", "security-framework",
"security-framework-sys", "security-framework-sys",
"webpki-root-certs", "webpki-root-certs",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -3524,7 +3425,7 @@ dependencies = [
"libloading", "libloading",
"sandbox-schema", "sandbox-schema",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -3535,7 +3436,7 @@ dependencies = [
"blake3", "blake3",
"ciborium", "ciborium",
"serde", "serde",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -3565,7 +3466,7 @@ dependencies = [
"rand 0.9.5", "rand 0.9.5",
"rustc-hash", "rustc-hash",
"slab", "slab",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -3983,33 +3884,13 @@ dependencies = [
"syn 3.0.4", "syn 3.0.4",
] ]
[[package]]
name = "thiserror"
version = "1.0.69"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
dependencies = [
"thiserror-impl 1.0.69",
]
[[package]] [[package]]
name = "thiserror" name = "thiserror"
version = "2.0.20" version = "2.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f" checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
dependencies = [ dependencies = [
"thiserror-impl 2.0.20", "thiserror-impl",
]
[[package]]
name = "thiserror-impl"
version = "1.0.69"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.119",
] ]
[[package]] [[package]]
@ -4087,17 +3968,6 @@ version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
[[package]]
name = "tls_codec"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0de2e01245e2bb89d6f05801c564fa27624dbd7b1846859876c7dad82e90bf6b"
dependencies = [
"serde",
"tls_codec_derive 0.4.2",
"zeroize",
]
[[package]] [[package]]
name = "tls_codec" name = "tls_codec"
version = "0.5.0" version = "0.5.0"
@ -4106,21 +3976,10 @@ checksum = "18cc98286004cea38f717e2b03d990fc774fbfd38a82720de40e5c94365067c8"
dependencies = [ dependencies = [
"serde", "serde",
"serde_bytes", "serde_bytes",
"tls_codec_derive 0.5.0", "tls_codec_derive",
"zeroize", "zeroize",
] ]
[[package]]
name = "tls_codec_derive"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2d2e76690929402faae40aebdda620a2c0e25dd6d3b9afe48867dfd95991f4bd"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.119",
]
[[package]] [[package]]
name = "tls_codec_derive" name = "tls_codec_derive"
version = "0.5.0" version = "0.5.0"
@ -4301,7 +4160,7 @@ dependencies = [
"log", "log",
"rand 0.9.5", "rand 0.9.5",
"sha1", "sha1",
"thiserror 2.0.20", "thiserror",
] ]
[[package]] [[package]]
@ -4503,7 +4362,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [ dependencies = [
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -4684,7 +4543,7 @@ dependencies = [
"rustls-pki-types", "rustls-pki-types",
"sha2 0.11.1", "sha2 0.11.1",
"socket2", "socket2",
"thiserror 2.0.20", "thiserror",
"time", "time",
"tokio", "tokio",
"tracing", "tracing",
@ -4701,7 +4560,7 @@ checksum = "aad9059572c7dbd6901ccef37f3b7321678cd708dcf58a64b1921dbeab7bfede"
dependencies = [ dependencies = [
"httlib-huffman", "httlib-huffman",
"octets", "octets",
"thiserror 2.0.20", "thiserror",
"url", "url",
] ]
@ -4766,7 +4625,7 @@ dependencies = [
"oid-registry", "oid-registry",
"ring", "ring",
"rusticata-macros", "rusticata-macros",
"thiserror 2.0.20", "thiserror",
"time", "time",
] ]

11
joule-code/joule-code-rs/crates/joule-code-collab/Cargo.toml
View file

@ -18,6 +18,11 @@ ed25519-dalek.workspace = true
rand = "0.8" rand = "0.8"
# MLS group keying (RFC 9420) for the collaborating set — demonstrated in # MLS group keying (RFC 9420) for the collaborating set — demonstrated in
# tests/mls_keying.rs. Dev-dep so the library's runtime deps stay light. # tests/mls_keying.rs. Dev-dep so the library's runtime deps stay light.
openmls = "0.6" # Pinned to the same generation joule-moq-mls runs in production. They were
openmls_rust_crypto = "0.3" # two generations apart, which put a second, older MLS stack in the test graph
openmls_basic_credential = "0.3" # and with it hpke-rs 0.2.0 — RUSTSEC-2026-0071 (nonce reuse in an HPKE
# context) and -0069/-0070/-0072. Nothing shipped it, but there is no reason to
# test RFC 9420 against an implementation production does not use.
openmls = "=0.9.1"
openmls_rust_crypto = "=0.6.0"
openmls_basic_credential = "=0.6.0"

4
joule-code/joule-code-rs/crates/joule-code-collab/tests/mls_keying.rs
View file

@ -45,7 +45,9 @@ fn key_package(
fn export(group: &MlsGroup, provider: &OpenMlsRustCrypto) -> Vec<u8> { fn export(group: &MlsGroup, provider: &OpenMlsRustCrypto) -> Vec<u8> {
group group
.export_secret(provider, EXPORT_LABEL, &[], 32) // openmls 0.9 takes the crypto backend here, not the whole provider —
// the same call joule-moq-mls makes in production.
.export_secret(provider.crypto(), EXPORT_LABEL, &[], 32)
.expect("export secret") .expect("export secret")
} }

10
joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock generated
View file

@ -283,9 +283,9 @@ dependencies = [
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.1" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cpufeatures 0.3.0", "cpufeatures 0.3.0",
@ -534,9 +534,9 @@ dependencies = [
[[package]] [[package]]
name = "ctutils" name = "ctutils"
version = "0.4.3" version = "0.4.4"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574" checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
dependencies = [ dependencies = [
"cmov", "cmov",
] ]
@ -2407,7 +2407,7 @@ version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
dependencies = [ dependencies = [
"chacha20 0.10.1", "chacha20 0.10.2",
"getrandom 0.4.3", "getrandom 0.4.3",
"rand_core 0.10.1", "rand_core 0.10.1",
] ]

6
jouleclaw/jouleclaw-rs/Cargo.lock generated
View file

@ -626,9 +626,9 @@ dependencies = [
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.1" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cpufeatures 0.3.0", "cpufeatures 0.3.0",
@ -6392,7 +6392,7 @@ version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
dependencies = [ dependencies = [
"chacha20 0.10.1", "chacha20 0.10.2",
"getrandom 0.4.3", "getrandom 0.4.3",
"rand_core 0.10.1", "rand_core 0.10.1",
] ]

7
jouleclaw/jouleclaw-rs/crates/jouleclaw-loader-gguf/src/openvino.rs
View file

@ -43,6 +43,7 @@ use std::sync::Arc;
use quick_xml::events::Event; use quick_xml::events::Event;
use quick_xml::reader::Reader; use quick_xml::reader::Reader;
use quick_xml::XmlVersion;
// ───────────────────────────────────────────────────────────────────── // ─────────────────────────────────────────────────────────────────────
// OpenVINO IR dtype enum // OpenVINO IR dtype enum
@ -286,7 +287,7 @@ pub fn parse_openvino_xml(
b"net" => { b"net" => {
for attr in e.attributes().flatten() { for attr in e.attributes().flatten() {
let key = attr.key.as_ref(); let key = attr.key.as_ref();
let val = attr.unescape_value().unwrap_or_default().to_string(); let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
match key { match key {
b"name" => net_name = val, b"name" => net_name = val,
b"version" => { b"version" => {
@ -301,7 +302,7 @@ pub fn parse_openvino_xml(
let mut name = String::new(); let mut name = String::new();
let mut ty = String::new(); let mut ty = String::new();
for attr in e.attributes().flatten() { for attr in e.attributes().flatten() {
let val = attr.unescape_value().unwrap_or_default().to_string(); let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
match attr.key.as_ref() { match attr.key.as_ref() {
b"id" => { id = val.parse().unwrap_or(0); } b"id" => { id = val.parse().unwrap_or(0); }
b"name" => { name = val; } b"name" => { name = val; }
@ -321,7 +322,7 @@ pub fn parse_openvino_xml(
} }
b"data" if in_layer_const => { b"data" if in_layer_const => {
for attr in e.attributes().flatten() { for attr in e.attributes().flatten() {
let val = attr.unescape_value().unwrap_or_default().to_string(); let val = attr.normalized_value(XmlVersion::Implicit1_0).unwrap_or_default().to_string();
match attr.key.as_ref() { match attr.key.as_ref() {
b"element_type" => { b"element_type" => {
cur_dtype = OvDtype::parse(&val); cur_dtype = OvDtype::parse(&val);

27
jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs
View file

@ -174,6 +174,7 @@ fn xml_escape(s: &str) -> String {
pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> { pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
use quick_xml::events::Event; use quick_xml::events::Event;
use quick_xml::Reader; use quick_xml::Reader;
use quick_xml::XmlVersion;
let mut reader = Reader::from_str(xml); let mut reader = Reader::from_str(xml);
// Deliberately no `trim_text(true)`: quick-xml reports an entity reference as // Deliberately no `trim_text(true)`: quick-xml reports an entity reference as
@ -193,7 +194,6 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
let mut cur_entity_properties: BTreeMap<String, serde_json::Value> = BTreeMap::new(); let mut cur_entity_properties: BTreeMap<String, serde_json::Value> = BTreeMap::new();
// Per-field scratch. // Per-field scratch.
let mut cur_field_name: Option<String> = None; let mut cur_field_name: Option<String> = None;
let mut cur_field_value: Option<String> = None;
// Per-UIMessage scratch. // Per-UIMessage scratch.
let mut cur_uimsg_kind: Option<UiMessageKind> = None; let mut cur_uimsg_kind: Option<UiMessageKind> = None;
@ -204,11 +204,6 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
// keeps `a &amp; b` from arriving as just `b`. // keeps `a &amp; b` from arriving as just `b`.
let mut chars = String::new(); let mut chars = String::new();
let mut in_value = false;
let mut in_weight = false;
let mut in_field = false;
let mut in_uimsg = false;
let mut entity_counter: usize = 0; let mut entity_counter: usize = 0;
loop { loop {
@ -222,40 +217,36 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
for attr in e.attributes().with_checks(false).flatten() { for attr in e.attributes().with_checks(false).flatten() {
if attr.key.as_ref() == b"Type" { if attr.key.as_ref() == b"Type" {
let v = attr let v = attr
.unescape_value() .normalized_value(XmlVersion::Implicit1_0)
.map_err(|err| TrxError::Decode(format!("entity attr: {err}")))?; .map_err(|err| TrxError::Decode(format!("entity attr: {err}")))?;
cur_entity_type = Some(v.into_owned()); cur_entity_type = Some(v.into_owned());
} }
} }
} }
"Value" => { "Value" => {
in_value = true;
chars.clear(); chars.clear();
} }
"Weight" => { "Weight" => {
in_weight = true;
chars.clear(); chars.clear();
} }
"Field" => { "Field" => {
in_field = true;
chars.clear(); chars.clear();
for attr in e.attributes().with_checks(false).flatten() { for attr in e.attributes().with_checks(false).flatten() {
if attr.key.as_ref() == b"Name" { if attr.key.as_ref() == b"Name" {
let v = attr let v = attr
.unescape_value() .normalized_value(XmlVersion::Implicit1_0)
.map_err(|err| TrxError::Decode(format!("field attr: {err}")))?; .map_err(|err| TrxError::Decode(format!("field attr: {err}")))?;
cur_field_name = Some(v.into_owned()); cur_field_name = Some(v.into_owned());
} }
} }
} }
"UIMessage" => { "UIMessage" => {
in_uimsg = true;
chars.clear(); chars.clear();
let mut kind = UiMessageKind::Inform; let mut kind = UiMessageKind::Inform;
for attr in e.attributes().with_checks(false).flatten() { for attr in e.attributes().with_checks(false).flatten() {
if attr.key.as_ref() == b"Type" { if attr.key.as_ref() == b"Type" {
let v = attr let v = attr
.unescape_value() .normalized_value(XmlVersion::Implicit1_0)
.map_err(|err| TrxError::Decode(format!("uimsg attr: {err}")))?; .map_err(|err| TrxError::Decode(format!("uimsg attr: {err}")))?;
kind = match v.as_ref() { kind = match v.as_ref() {
"Inform" => UiMessageKind::Inform, "Inform" => UiMessageKind::Inform,
@ -312,29 +303,23 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
.to_string(); .to_string();
match name.as_str() { match name.as_str() {
"Value" => { "Value" => {
in_value = false;
cur_entity_value = Some(chars.trim().to_string()); cur_entity_value = Some(chars.trim().to_string());
chars.clear(); chars.clear();
} }
"Weight" => { "Weight" => {
in_weight = false;
cur_entity_weight = chars.trim().parse::<f64>().ok(); cur_entity_weight = chars.trim().parse::<f64>().ok();
chars.clear(); chars.clear();
} }
"Field" => { "Field" => {
cur_field_value = Some(chars.trim().to_string()); let v = chars.trim().to_string();
chars.clear(); chars.clear();
if let (Some(n), Some(v)) = if let Some(n) = cur_field_name.take() {
(cur_field_name.take(), cur_field_value.take())
{
let val = serde_json::from_str::<serde_json::Value>(&v) let val = serde_json::from_str::<serde_json::Value>(&v)
.unwrap_or(serde_json::Value::String(v)); .unwrap_or(serde_json::Value::String(v));
cur_entity_properties.insert(n, val); cur_entity_properties.insert(n, val);
} }
in_field = false;
} }
"UIMessage" => { "UIMessage" => {
in_uimsg = false;
if let Some(kind) = cur_uimsg_kind.take() { if let Some(kind) = cur_uimsg_kind.take() {
messages.push(UiMessage { messages.push(UiMessage {
kind, kind,

4
jouledesk/jouledesk-rs/Cargo.lock generated
View file

@ -198,9 +198,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.1" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cpufeatures 0.3.0", "cpufeatures 0.3.0",

4
openpay/Cargo.lock generated
View file

@ -1395,9 +1395,9 @@ dependencies = [
[[package]] [[package]]
name = "ctutils" name = "ctutils"
version = "0.4.3" version = "0.4.4"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574" checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
dependencies = [ dependencies = [
"cmov", "cmov",
] ]

106
scripts/check-advisories-selftest.sh
View file

@ -4,17 +4,21 @@
# #
# A check that cannot fail is decoration. This feeds the check pre-captured # A check that cannot fail is decoration. This feeds the check pre-captured
# `cargo audit --json` documents through `--from-json` and asserts that it # `cargo audit --json` documents through `--from-json` and asserts that it
# 1. passes when every advisory found is allowed and every allowed advisory # 1. passes when every advisory found is allowed and every allowance is used;
# is found;
# 2. fails when an advisory is reported that the allow list does not name # 2. fails when an advisory is reported that the allow list does not name
# (the case this check exists for); # (the case this check exists for);
# 3. fails when an allow-list entry matches nothing, so an excuse cannot # 3. fails when an allow-list entry matches nothing, so an excuse cannot
# outlive the exposure it was written for; # outlive the exposure it was written for;
# 4. fails, and says it could not audit, when the document does not parse: # 4. fails when a version-pinned allowance is offered a version it does not
# name — the whole point of pinning it;
# 5. fails when a version-pinned allowance names a pair that is gone, so the
# pin cannot keep describing a tree that moved;
# 6. fails, and says it could not audit, when the document does not parse:
# an error is never read as "clean". # an error is never read as "clean".
# #
# Nothing here runs cargo or reads the advisory database, so it needs no # The documents are generated from the check's own ALLOW table, imported rather
# network and no lockfile. # than scraped, so the two cannot drift apart. Nothing here runs cargo or reads
# the advisory database, so it needs no network and no lockfile.
set -uo pipefail set -uo pipefail
here=$(cd "$(dirname "$0")" && pwd) here=$(cd "$(dirname "$0")" && pwd)
@ -22,37 +26,53 @@ check="$here/check-advisories.py"
tmp=$(mktemp -d) tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT trap 'rm -rf "$tmp"' EXIT
# Every advisory the check allows, read from the check itself so the two cannot # gen <out> [mutation] — a cargo-audit document built from the real ALLOW.
# drift apart. # (none) every allowance, each at a version it covers
# (a read loop, not `mapfile`: macOS ships bash 3.2, where mapfile does not exist) # extra plus an advisory nobody allows
allowed=() # drop-one one allowance missing, so it matches nothing
while IFS= read -r id; do allowed+=("$id"); done < <( # wrong-ver a version-pinned allowance at a version it does not name
grep -oE '^ "RUSTSEC-[0-9]{4}-[0-9]{4}"' "$check" | tr -d ' "' # drop-pinned a version-pinned allowance's named pair removed
) gen() {
if [ ${#allowed[@]} -eq 0 ]; then python3 -I - "$check" "$1" "${2:-none}" <<'PY'
echo "selftest: could not read the allow list out of $check" >&2 import importlib.util, json, sys
exit 2 path, out, mode = sys.argv[1], sys.argv[2], sys.argv[3]
fi spec = importlib.util.spec_from_file_location("chk", path)
m = importlib.util.module_from_spec(spec)
spec.loader.exec_module(m) # __name__ != "__main__", so main() stays put
# write_json <file> <id>... — a cargo-audit document reporting exactly these. rows = []
write_json() { for adv, entry in m.ALLOW.items():
local out=$1; shift if isinstance(entry, str):
{ printf '{"vulnerabilities":{"found":true,"count":%d,"list":[' "$#" rows.append((adv, "c", "1.0.0"))
local first=1 id else:
for id in "$@"; do for pair in entry["only"]:
[ $first -eq 1 ] || printf ',' crate, ver = pair.rsplit(" ", 1)
first=0 rows.append((adv, crate, ver))
printf '{"advisory":{"id":"%s","title":"t"},"package":{"name":"c","version":"1.0.0"}}' "$id"
done pinned = [a for a, e in m.ALLOW.items() if not isinstance(e, str)]
printf ']},"warnings":{}}' if mode == "extra":
} > "$out" rows.append(("RUSTSEC-2099-0001", "c", "1.0.0"))
elif mode == "drop-one":
rows.pop(0)
elif mode == "wrong-ver":
assert pinned, "no version-pinned allowance to test"
rows = [(a, c, ("9.9.9" if a == pinned[0] else v)) for a, c, v in rows]
elif mode == "drop-pinned":
assert pinned, "no version-pinned allowance to test"
rows = [(a, c, v) for a, c, v in rows if a != pinned[0]]
rows.append((pinned[0], "c", "1.0.0")) # present, but not at a named pair
doc = {"vulnerabilities": {"found": bool(rows), "count": len(rows), "list": [
{"advisory": {"id": a, "title": "t"}, "package": {"name": c, "version": v}}
for a, c, v in rows]}, "warnings": {}}
open(out, "w").write(json.dumps(doc))
PY
} }
fails=0 fails=0
expect() { # expect <pass|fail> <what> [text the output must hold] -- <args...> expect() { # expect <pass|fail> <what> <needle> <file>
local want=$1 what=$2 needle=$3; shift 3; [ "${1:-}" = -- ] && shift local want=$1 what=$2 needle=$3 file=$4 out rc
local out rc out=$(python3 -I "$check" --from-json "$file" 2>&1); rc=$?
out=$(python3 -I "$check" --from-json "$@" 2>&1); rc=$?
if [ "$want" = pass ] && [ $rc -ne 0 ]; then if [ "$want" = pass ] && [ $rc -ne 0 ]; then
echo "FAIL $what: the check failed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return echo "FAIL $what: the check failed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return
fi fi
@ -65,17 +85,19 @@ expect() { # expect <pass|fail> <what> [text the output must hold] -- <args...>
echo "ok $what" echo "ok $what"
} }
write_json "$tmp/all.json" "${allowed[@]}" gen "$tmp/all.json" || exit 2
expect pass "every advisory allowed and every allowance used passes" "" -- "$tmp/all.json" gen "$tmp/extra.json" extra || exit 2
gen "$tmp/short.json" drop-one || exit 2
write_json "$tmp/extra.json" "${allowed[@]}" "RUSTSEC-2099-0001" gen "$tmp/wrongver.json" wrong-ver || exit 2
expect fail "an advisory the allow list does not name fails" "not in the allow list" -- "$tmp/extra.json" gen "$tmp/dropped.json" drop-pinned || exit 2
write_json "$tmp/short.json" "${allowed[@]:1}"
expect fail "an allowance that matches nothing fails" "no longer match anything" -- "$tmp/short.json"
printf 'this is not json\n' > "$tmp/broken.json" printf 'this is not json\n' > "$tmp/broken.json"
expect fail "a document that does not parse fails as unaudited, not as clean" "Could not be audited" -- "$tmp/broken.json"
expect pass "every advisory allowed and every allowance used passes" "" "$tmp/all.json"
expect fail "an advisory the allow list does not name fails" "not in the allow list" "$tmp/extra.json"
expect fail "an allowance that matches nothing fails" "no longer match anything" "$tmp/short.json"
expect fail "a version-pinned allowance at an unnamed version fails" "not in the allow list" "$tmp/wrongver.json"
expect fail "a version-pinned allowance whose named pair is gone fails" "no longer" "$tmp/dropped.json"
expect fail "a document that does not parse fails as unaudited, not as clean" "Could not be audited" "$tmp/broken.json"
if [ $fails -ne 0 ]; then echo "check-advisories-selftest: $fails failure(s)"; exit 1; fi if [ $fails -ne 0 ]; then echo "check-advisories-selftest: $fails failure(s)"; exit 1; fi
echo "check-advisories-selftest: the check passes a reviewed tree and fails each way it should." echo "check-advisories-selftest: the check passes a reviewed tree and fails each way it should."

84
scripts/check-advisories.py
View file

@ -45,6 +45,21 @@ import sys
# Advisories left in place on purpose. Each needs the reason, and each must # Advisories left in place on purpose. Each needs the reason, and each must
# still be reported by at least one lockfile or this check fails. # still be reported by at least one lockfile or this check fails.
#
# An entry is either
#
# "RUSTSEC-...": "why it can be left"
#
# which excuses the advisory at ANY version — correct when the reason does not
# depend on the version, such as a call we never make — or
#
# "RUSTSEC-...": {"why": "...", "only": ("crate 1.2.3", ...)}
#
# which excuses it ONLY at those exact crate/version pairs. Use the second form
# whenever the reason is "this particular line cannot move yet", because the
# first form is version-blind: it would go on excusing the advisory if a
# patched line later regressed to an unpatched release. Every pair named in
# `only` must also still appear, or the entry is stale and the run fails.
ALLOW = { ALLOW = {
# ── Unreachable here ──────────────────────────────────────────────────── # ── Unreachable here ────────────────────────────────────────────────────
# All three are faults in `extract()`: SUID/SGID bits preserved from the # All three are faults in `extract()`: SUID/SGID bits preserved from the
@ -61,30 +76,36 @@ ALLOW = {
# sandbox-rs and wai-rs transitively and neither holds an RSA private key # sandbox-rs and wai-rs transitively and neither holds an RSA private key
# nor decrypts: openpay's unused direct dependency was removed outright. # nor decrypts: openpay's unused direct dependency was removed outright.
"RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here", "RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here",
# ── Not in a shipped artifact ──────────────────────────────────────────
# The production MLS path (joule-moq-mls) resolves the patched hpke-rs
# 0.7.0. These four are the old 0.2.0, reached only through a
# [dev-dependencies] edge of joule-code-collab, which still pins the
# openmls 0.6/0.3 stack. Test graph only; aligning it to the 0.9.1/0.6.0
# stack already used in-repo would remove them.
"RUSTSEC-2026-0069": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0070": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0071": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0072": "hpke-rs-rust-crypto 0.2.0: dev-dependency only",
# ── Pinned by a dependency; needs an upstream release ────────────────── # ── Pinned by a dependency; needs an upstream release ──────────────────
# Secret-dependent branches in operations meant to be constant-time
# (subtraction, zero counting, division, Montgomery multiplication), so
# timing can leak intermediate arithmetic on secret integers. Fixed in
# >=0.7.6, and smart-byte's 0.7.x copy is patched. The 0.5.5 line is pinned
# by elliptic-curve 0.13, so reaching it means moving the whole
# p256/elliptic-curve stack — a real upgrade, not a bump, and this entry is
# that debt, recorded on paths that sign and derive keys. Version-pinned on
# purpose: a 0.7.x copy must never be excused by it.
"RUSTSEC-2026-0387": {
"why": "crypto-bigint 0.5.5 is pinned by elliptic-curve 0.13; 0.7.x is patched",
"only": ("crypto-bigint 0.5.5",),
},
# hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are # hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are
# panics on short or malformed hybrid keys — denial of service, not memory # panics on short or malformed hybrid keys — denial of service, not memory
# corruption. Fixed by an openmls/hpke-rs release, not from here. # corruption. Fixed by an openmls/hpke-rs release, not from here.
"RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream", "RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
"RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream", "RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
# quick-xml is 0.41 everywhere the version is ours to choose. openpay also # quick-xml is 0.41 everywhere the version is ours to choose, which includes
# resolves 0.37.5 through open-payments-iso20022 1.0.10 (no later release # every call that actually parses: op-iso20022's codec binds the workspace
# exists), and smart-byte resolves 0.39.4 through plist -> netdev -> # 0.41. Two older copies remain in the graph, neither on a parse path.
# netwatch -> iroh. NOTE: the openpay path is the same ISO 20022 surface we # openpay resolves 0.37.5 through open-payments-iso20022 1.0.10, which
# harden directly, so this entry is a known remaining exposure on a payment # declares quick-xml but never calls it — the crate ships serde-annotated
# ingestion path, not a dismissal. Drop it the moment upstream ships. # ISO 20022 types (3 files, ~2.2k lines, no `quick_xml` reference), and
"RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: pinned by open-payments-iso20022 and iroh", # the parsing is ours. Compiled, never executed.
"RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused here; dependents pin the version", # smart-byte resolves 0.39.4 through plist -> netdev -> netwatch -> iroh,
# which parses macOS plists, not counterparty XML.
# -0195 additionally needs `NsReader`, which appears nowhere in this tree.
"RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: not on a parse path; our parsing is on 0.41",
"RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused, and neither copy parses",
# h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive; # h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive;
# the fix is a major move for the dependent. # the fix is a major move for the dependent.
"RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent", "RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent",
@ -189,8 +210,29 @@ def main():
for kind, items in (data.get("warnings") or {}).items(): for kind, items in (data.get("warnings") or {}).items():
warn_count += len(items or []) warn_count += len(items or [])
unexpected = {k: v for k, v in found.items() if k not in ALLOW} def covered(adv, crate, ver):
entry = ALLOW.get(adv)
if entry is None:
return False
if isinstance(entry, str):
return True
return f"{crate} {ver}" in entry["only"]
unexpected = {}
for adv, occurrences in found.items():
loose = [o for o in occurrences if not covered(adv, o[0], o[1])]
if loose:
unexpected[adv] = loose
stale = [k for k in ALLOW if k not in found] stale = [k for k in ALLOW if k not in found]
# A version-pinned entry is also stale when a pair it names is gone: the
# pin stops describing the tree the moment that line moves.
for adv, entry in ALLOW.items():
if adv in found and isinstance(entry, dict):
seen = {f"{c} {v}" for c, v, _ in found[adv]}
for pair in entry["only"]:
if pair not in seen:
stale.append(f"{adv} (no longer at {pair})")
if unexpected: if unexpected:
print("Advisories that are not in the allow list:\n") print("Advisories that are not in the allow list:\n")
@ -205,7 +247,9 @@ def main():
if stale: if stale:
print("\nAllow-list entries that no longer match anything:\n") print("\nAllow-list entries that no longer match anything:\n")
for adv in sorted(stale): for adv in sorted(stale):
print(f" {adv} — {ALLOW[adv]}") entry = ALLOW.get(adv.split(" (")[0])
why = entry if isinstance(entry, str) else (entry or {}).get("why", "")
print(f" {adv} — {why}")
print( print(
"\nThe exposure is gone. Remove the entry, so the list keeps describing\n" "\nThe exposure is gone. Remove the entry, so the list keeps describing\n"
"the tree instead of hiding it." "the tree instead of hiding it."

81
smart-byte/smart-byte-rs/Cargo.lock generated
View file

@ -150,9 +150,9 @@ dependencies = [
[[package]] [[package]]
name = "anyhow" name = "anyhow"
version = "1.0.102" version = "1.0.103"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
[[package]] [[package]]
name = "arc-swap" name = "arc-swap"
@ -711,9 +711,9 @@ dependencies = [
[[package]] [[package]]
name = "chacha20" name = "chacha20"
version = "0.10.0" version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
dependencies = [ dependencies = [
"cfg-if", "cfg-if",
"cipher 0.5.2", "cipher 0.5.2",
@ -1045,9 +1045,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
[[package]] [[package]]
name = "crypto-bigint" name = "crypto-bigint"
version = "0.7.3" version = "0.7.6"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "42a0d26b245348befa0c121944541476763dcc46ede886c88f9d12e1697d27c3" checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
dependencies = [ dependencies = [
"cpubits", "cpubits",
"ctutils", "ctutils",
@ -1090,9 +1090,9 @@ dependencies = [
[[package]] [[package]]
name = "ctutils" name = "ctutils"
version = "0.4.2" version = "0.4.5"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
dependencies = [ dependencies = [
"cmov", "cmov",
"subtle", "subtle",
@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
dependencies = [ dependencies = [
"data-encoding", "data-encoding",
"syn 1.0.109", "syn 2.0.117",
] ]
[[package]] [[package]]
@ -1251,9 +1251,9 @@ dependencies = [
[[package]] [[package]]
name = "der" name = "der"
version = "0.8.0" version = "0.8.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "71fd89660b2dc699704064e59e9dba0147b903e85319429e131620d022be411b" checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
dependencies = [ dependencies = [
"const-oid 0.10.2", "const-oid 0.10.2",
"pem-rfc7468", "pem-rfc7468",
@ -1427,7 +1427,7 @@ version = "0.17.0-rc.18"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "54fb064faabbee66e1fc8e5c5a9458d4269dc2d8b638fe86a425adb2510d1a96" checksum = "54fb064faabbee66e1fc8e5c5a9458d4269dc2d8b638fe86a425adb2510d1a96"
dependencies = [ dependencies = [
"der 0.8.0", "der 0.8.2",
"digest 0.11.3", "digest 0.11.3",
"elliptic-curve", "elliptic-curve",
"rfc6979", "rfc6979",
@ -1564,16 +1564,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [ dependencies = [
"libc", "libc",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
name = "event-listener" name = "event-listener"
version = "5.4.1" version = "5.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
dependencies = [ dependencies = [
"concurrent-queue",
"parking", "parking",
"pin-project-lite", "pin-project-lite",
] ]
@ -1715,7 +1714,7 @@ dependencies = [
"diatomic-waker", "diatomic-waker",
"futures-core", "futures-core",
"pin-project-lite", "pin-project-lite",
"spin 0.10.0", "spin 0.10.1",
] ]
[[package]] [[package]]
@ -2070,7 +2069,7 @@ dependencies = [
"hash32", "hash32",
"rustc_version", "rustc_version",
"serde", "serde",
"spin 0.9.8", "spin 0.9.9",
"stable_deref_trait", "stable_deref_trait",
] ]
@ -2377,7 +2376,7 @@ dependencies = [
"libc", "libc",
"percent-encoding", "percent-encoding",
"pin-project-lite", "pin-project-lite",
"socket2 0.5.10", "socket2 0.6.3",
"tokio", "tokio",
"tower-service", "tower-service",
"tracing", "tracing",
@ -2786,9 +2785,9 @@ dependencies = [
[[package]] [[package]]
name = "iroh-blobs" name = "iroh-blobs"
version = "0.101.0" version = "0.101.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c6e351f5c1db08dcfb456e6299bda0881e1ba95a360f0913a5e57344c1538fb2" checksum = "7b9674590d5b678af0989a7ed77d24b57f88bad45e4729c08f66c7177b1c0b6e"
dependencies = [ dependencies = [
"arrayvec", "arrayvec",
"bao-tree", "bao-tree",
@ -3665,9 +3664,9 @@ dependencies = [
[[package]] [[package]]
name = "lru" name = "lru"
version = "0.18.0" version = "0.18.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8a860605968fce16869fd239cf4237a82f3ac470723415db603b0e8b6c8d4fb9" checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a"
dependencies = [ dependencies = [
"hashbrown 0.17.1", "hashbrown 0.17.1",
] ]
@ -4065,7 +4064,7 @@ dependencies = [
"pin-project-lite", "pin-project-lite",
"rustc-hash", "rustc-hash",
"rustls", "rustls",
"socket2 0.5.10", "socket2 0.6.3",
"thiserror 2.0.18", "thiserror 2.0.18",
"tokio", "tokio",
"tokio-stream", "tokio-stream",
@ -4110,7 +4109,7 @@ checksum = "78633d1fe1bde91d12bcabb230ac9edb890857414c6d44f3212e0d309525b5ff"
dependencies = [ dependencies = [
"cfg_aliases", "cfg_aliases",
"libc", "libc",
"socket2 0.5.10", "socket2 0.6.3",
"tracing", "tracing",
"windows-sys 0.61.2", "windows-sys 0.61.2",
] ]
@ -4480,7 +4479,7 @@ version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7" checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
dependencies = [ dependencies = [
"der 0.8.0", "der 0.8.2",
"spki 0.8.0", "spki 0.8.0",
] ]
@ -4906,7 +4905,7 @@ dependencies = [
"quinn-udp", "quinn-udp",
"rustc-hash", "rustc-hash",
"rustls", "rustls",
"socket2 0.5.10", "socket2 0.6.3",
"thiserror 2.0.18", "thiserror 2.0.18",
"tokio", "tokio",
"tracing", "tracing",
@ -4945,7 +4944,7 @@ dependencies = [
"cfg_aliases", "cfg_aliases",
"libc", "libc",
"once_cell", "once_cell",
"socket2 0.5.10", "socket2 0.6.3",
"tracing", "tracing",
"windows-sys 0.52.0", "windows-sys 0.52.0",
] ]
@ -4998,7 +4997,7 @@ version = "0.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207" checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
dependencies = [ dependencies = [
"chacha20 0.10.0", "chacha20 0.10.2",
"getrandom 0.4.2", "getrandom 0.4.2",
"rand_core 0.10.1", "rand_core 0.10.1",
] ]
@ -5343,7 +5342,7 @@ dependencies = [
"errno", "errno",
"libc", "libc",
"linux-raw-sys", "linux-raw-sys",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -5402,7 +5401,7 @@ dependencies = [
"security-framework", "security-framework",
"security-framework-sys", "security-framework-sys",
"webpki-root-certs", "webpki-root-certs",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -5502,7 +5501,7 @@ checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
dependencies = [ dependencies = [
"base16ct", "base16ct",
"ctutils", "ctutils",
"der 0.8.0", "der 0.8.2",
"hybrid-array", "hybrid-array",
"subtle", "subtle",
"zeroize", "zeroize",
@ -5558,7 +5557,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521" checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521"
dependencies = [ dependencies = [
"libc", "libc",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -6164,7 +6163,7 @@ dependencies = [
"aes", "aes",
"async-trait", "async-trait",
"cbc", "cbc",
"chacha20 0.10.0", "chacha20 0.10.2",
"chrono", "chrono",
"data-encoding", "data-encoding",
"hex", "hex",
@ -6350,18 +6349,18 @@ dependencies = [
[[package]] [[package]]
name = "spin" name = "spin"
version = "0.9.8" version = "0.9.9"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
dependencies = [ dependencies = [
"lock_api", "lock_api",
] ]
[[package]] [[package]]
name = "spin" name = "spin"
version = "0.10.0" version = "0.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591" checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
[[package]] [[package]]
name = "spki" name = "spki"
@ -6380,7 +6379,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f" checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
dependencies = [ dependencies = [
"base64ct", "base64ct",
"der 0.8.0", "der 0.8.2",
] ]
[[package]] [[package]]
@ -6538,7 +6537,7 @@ dependencies = [
"getrandom 0.4.2", "getrandom 0.4.2",
"once_cell", "once_cell",
"rustix", "rustix",
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]
@ -7260,7 +7259,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [ dependencies = [
"windows-sys 0.52.0", "windows-sys 0.61.2",
] ]
[[package]] [[package]]