sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410; CI: the avx2 leg on the framework runner #492
10 changed files with 71 additions and 38 deletions
14
.github/workflows/wai-quantum-vector.yml
vendored
14
.github/workflows/wai-quantum-vector.yml
vendored
|
|
@ -4,7 +4,10 @@ name: wai-quantum CPU vector units
|
|||
# the processor's own vector extension, certified bit-exact against the CPU
|
||||
# reference's pinned corpus digests.
|
||||
#
|
||||
# - avx2 on silicon: the container runner's x86-64 processor;
|
||||
# - avx2 on silicon: the x86-64 processor of whichever `linux` runner takes
|
||||
# the leg. jetson-hub's has avx2 alone; framework-128gb-linux's has avx512
|
||||
# too, and there the leg declares both, as the kernel reports them, and
|
||||
# checks the avx2 member as on any other;
|
||||
# - avx2 and avx512 on silicon together: framework-128gb's processor, which has
|
||||
# both, one member each;
|
||||
# - sve and rvv under the host's user-mode emulator (its binfmt handler), at
|
||||
|
|
@ -150,6 +153,11 @@ jobs:
|
|||
rustup target add ${{ matrix.target }}
|
||||
# The emulated processor, for the test binaries only.
|
||||
if [ -n "${{ matrix.qemu_cpu }}" ]; then export QEMU_CPU="${{ matrix.qemu_cpu }}"; fi
|
||||
# Every unit this processor has must be declared, so on silicon the
|
||||
# declaration comes from the kernel's own flags, not the probe under test.
|
||||
if [ "${{ matrix.key }}" = cpu-vector-avx2 ] && grep -qw avx512f /proc/cpuinfo; then
|
||||
export WAI_QUANTUM_VECTOR_EXPECT=cpu-vector-avx2,cpu-vector-avx512
|
||||
fi
|
||||
t="--target ${{ matrix.target }} --features quantum_fabric_vector"
|
||||
cargo test --locked --release -j 6 $t --lib -- quantum_fabric_vector:: 2>&1 | tee "$cache/unit.log"
|
||||
grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$cache/unit.log" || { echo "::error::no unit test ran"; exit 1; }
|
||||
|
|
@ -157,8 +165,8 @@ jobs:
|
|||
WAI_QUANTUM_VECTOR_REPORT="$report" cargo test --locked --release -j 6 $t --test vector_member -- --test-threads=1 2>&1 | tee "$cache/device.log"
|
||||
grep -qE '^test result: ok\. 9 passed; 0 failed' "$cache/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
|
||||
cat "$report"
|
||||
key="$WAI_QUANTUM_VECTOR_EXPECT"
|
||||
grep -qx "vector devices: as declared ($key)" "$report" || { echo "::error::the unit found is not the declared one"; exit 1; }
|
||||
key="${{ matrix.key }}"
|
||||
grep -qx "vector devices: as declared ($WAI_QUANTUM_VECTOR_EXPECT)" "$report" || { echo "::error::the units found are not the declared ones"; exit 1; }
|
||||
grep -q "^vector member: key=$key .* bits=${{ matrix.bits }} " "$report" || { echo "::error::the unit's vector length is not ${{ matrix.bits }} bits"; exit 1; }
|
||||
if [ -n "$WAI_QUANTUM_VECTOR_EMULATOR" ]; then
|
||||
grep -q "^vector member: key=$key .*emulator:qemu-user" "$report" || { echo "::error::the member does not say it ran under the emulator"; exit 1; }
|
||||
|
|
|
|||
12
joule-code/examples/transport-moqt/Cargo.lock
generated
12
joule-code/examples/transport-moqt/Cargo.lock
generated
|
|
@ -1339,27 +1339,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
|||
|
||||
[[package]]
|
||||
name = "zstd"
|
||||
version = "0.13.3"
|
||||
version = "0.14.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
|
||||
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
|
||||
dependencies = [
|
||||
"zstd-safe",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-safe"
|
||||
version = "7.2.4"
|
||||
version = "8.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
|
||||
checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
|
||||
dependencies = [
|
||||
"zstd-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.0.16+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
|
|
|||
12
joule-code/joule-code-rs/Cargo.lock
generated
12
joule-code/joule-code-rs/Cargo.lock
generated
|
|
@ -4764,27 +4764,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
|||
|
||||
[[package]]
|
||||
name = "zstd"
|
||||
version = "0.13.3"
|
||||
version = "0.14.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
|
||||
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
|
||||
dependencies = [
|
||||
"zstd-safe",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-safe"
|
||||
version = "7.2.4"
|
||||
version = "8.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
|
||||
checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
|
||||
dependencies = [
|
||||
"zstd-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.0.16+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "macros",
|
|||
bytes = "1"
|
||||
ed25519-dalek = { version = "2", features = ["rand_core"] }
|
||||
serde_json = "1"
|
||||
zstd = "0.13"
|
||||
zstd = "0.14.3"
|
||||
hex = "0.4"
|
||||
async-trait = "0.1"
|
||||
blake3 = "1"
|
||||
|
|
|
|||
|
|
@ -3928,27 +3928,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
|||
|
||||
[[package]]
|
||||
name = "zstd"
|
||||
version = "0.13.3"
|
||||
version = "0.14.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
|
||||
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
|
||||
dependencies = [
|
||||
"zstd-safe",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-safe"
|
||||
version = "7.2.4"
|
||||
version = "8.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
|
||||
checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
|
||||
dependencies = [
|
||||
"zstd-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.0.16+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ serde = { version = "1", features = ["derive"] }
|
|||
serde_json = "1"
|
||||
thiserror = "2"
|
||||
tracing = "0.1"
|
||||
zstd = "0.13"
|
||||
zstd = "0.14.3"
|
||||
lz4_flex = "0.13"
|
||||
futures-util = { version = "0.3", features = ["sink"] }
|
||||
quinn = { version = "0.11", optional = true }
|
||||
|
|
|
|||
|
|
@ -91,6 +91,31 @@ ALLOW = {
|
|||
# was removed outright rather than excused.
|
||||
"RUSTSEC-2023-0071": "rsa: no fixed release; verification only, no decryption, private keys test-only",
|
||||
# ── Pinned by a dependency; needs an upstream release ──────────────────
|
||||
# zstd's four October 2026 advisories (a stream's data leaking into the
|
||||
# next on a reused context; Seekable::decompress past the end; uninitialised
|
||||
# memory from a failed legacy-frame stream; the wasm allocator shim). Every
|
||||
# direct use here moved to zstd 0.14.3 / zstd-safe 8.2.0 / zstd-sys 2.1.2.
|
||||
# The one copy left is wasmtime 49's: wasmtime-internal-cache compresses
|
||||
# compiled modules for wasmtime's on-disk cache, and sandbox-exec-wasm
|
||||
# builds its engine from Config::new() with fuel metering only and never
|
||||
# configures a cache, so none of zstd's code runs in the sandbox. Pinned to
|
||||
# those exact versions: a direct use regressing to them is not excused.
|
||||
"RUSTSEC-2026-0391": {
|
||||
"why": "zstd 0.13.3 only in wasmtime 49's module cache, which the sandbox never configures",
|
||||
"only": ("zstd 0.13.3",),
|
||||
},
|
||||
"RUSTSEC-2026-0398": {
|
||||
"why": "zstd-safe 7.2.4 only under wasmtime 49's module cache, which the sandbox never configures",
|
||||
"only": ("zstd-safe 7.2.4",),
|
||||
},
|
||||
"RUSTSEC-2026-0403": {
|
||||
"why": "zstd-safe 7.2.4 only under wasmtime 49's module cache, which the sandbox never configures",
|
||||
"only": ("zstd-safe 7.2.4",),
|
||||
},
|
||||
"RUSTSEC-2026-0410": {
|
||||
"why": "zstd-sys 2.0.16 only under wasmtime 49's module cache, never configured, and native: the shim is wasm's",
|
||||
"only": ("zstd-sys 2.0.16+zstd.1.5.7",),
|
||||
},
|
||||
# Secret-dependent branches in operations meant to be constant-time
|
||||
# (subtraction, zero counting, division, Montgomery multiplication), so
|
||||
# timing can leak intermediate arithmetic on a secret integer. Fixed in
|
||||
|
|
|
|||
12
wai/wai-rs/Cargo.lock
generated
12
wai/wai-rs/Cargo.lock
generated
|
|
@ -5252,27 +5252,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
|||
|
||||
[[package]]
|
||||
name = "zstd"
|
||||
version = "0.13.3"
|
||||
version = "0.14.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
|
||||
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
|
||||
dependencies = [
|
||||
"zstd-safe",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-safe"
|
||||
version = "7.2.4"
|
||||
version = "8.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
|
||||
checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
|
||||
dependencies = [
|
||||
"zstd-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.0.16+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
|
|
|||
|
|
@ -52,7 +52,7 @@ flac-bound = { version = "0.5", optional = true } # FLAC encode (libFLAC)
|
|||
rav1e = { version = "0.8", default-features = false, features = ["threading"], optional = true }
|
||||
dav1d = { version = "0.11", optional = true } # AV1 decode (libdav1d)
|
||||
# Text
|
||||
zstd = { version = "0.13", optional = true } # zstd bindings
|
||||
zstd = { version = "0.14.3", optional = true } # zstd bindings (0.14.3: RUSTSEC-2026-0391, -0398, -0403, -0410)
|
||||
xz2 = { version = "0.1", optional = true } # liblzma bindings (XZ/LZMA)
|
||||
|
||||
# Bytestream framing for video container (we wrap rav1e packets into a
|
||||
|
|
@ -73,7 +73,7 @@ ndarray = { version = "0.17", optional = true }
|
|||
# library or wasm32 build enables the feature. ring is the provider already in the graph.
|
||||
rustls = { version = "0.23", default-features = false, features = ["std", "ring", "tls12"], optional = true }
|
||||
rustls-platform-verifier = { version = "0.7", optional = true }
|
||||
zstd-safe = { version = "7", optional = true, features = ["std"] } # for bmshj2018 latent unpack (std → WriteBuf for Vec)
|
||||
zstd-safe = { version = "8.2", optional = true, features = ["std"] } # for bmshj2018 latent unpack (std → WriteBuf for Vec)
|
||||
# SHA-256 is WAI's digest for parameter-set identity, component identity and decoded-output
|
||||
# conformance digests (SPEC §3.1, §7 *Digests*, §7.1). Pure Rust, so it is always on: the
|
||||
# envelope reader verifies a component digest and a pin with no feature enabled.
|
||||
|
|
|
|||
14
wai/wai-rs/fuzz/Cargo.lock
generated
14
wai/wai-rs/fuzz/Cargo.lock
generated
|
|
@ -1475,7 +1475,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
|
||||
dependencies = [
|
||||
"fastrand",
|
||||
"getrandom 0.4.3",
|
||||
"getrandom 0.3.4",
|
||||
"once_cell",
|
||||
"rustix",
|
||||
"windows-sys",
|
||||
|
|
@ -1788,27 +1788,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
|||
|
||||
[[package]]
|
||||
name = "zstd"
|
||||
version = "0.13.3"
|
||||
version = "0.14.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
|
||||
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
|
||||
dependencies = [
|
||||
"zstd-safe",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-safe"
|
||||
version = "7.3.0"
|
||||
version = "8.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
|
||||
checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
|
||||
dependencies = [
|
||||
"zstd-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.1.1+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
|
|
|||
Loading…
Reference in a new issue