From 5fc877996884400067b2c48162ae7e4954ccbf3e Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Mon, 2 Nov 2026 06:31:12 -0500 Subject: [PATCH] sec: RUSTSEC-2026-0429, a zip archive that aborts the process on extract `ZipArchive::extract` sizes a symlink target's buffer from the size the archive declares, so a 112-byte archive aborts the process. Fixed in zip 9. The audit went red on every open PR when the advisory was published. Two lockfiles move: wai-quantum-desktop: tauri-plugin-updater 2.14.0 -> 2.14.1. Its source is unchanged; it asks for zip 9. This was the only copy that runs `extract` in a shipped program, on Windows, on an update package whose signature has already been checked. wai-rs: c2pa 0.90 -> 0.91, behind `c2pa_emit`. This also takes elliptic-curve 0.14, so the workspace holds no crypto-bigint 0.5. Four copies stay, each read at its call site and allowed at its exact version: open_board_format and candle-core never call `extract`, and webrtc-sys-build calls it in a build script, on its own download. The build crate's next releases change which libwebrtc it downloads, so it moves with livekit. The comment over the older zip entries said nothing in this tree extracts an archive. It was wrong: the updater did, and the build script does. It now says what is true. Co-Authored-By: Claude Opus 5.5 --- scripts/check-advisories.py | 42 +++- wai/CHANGELOG.md | 6 + wai/wai-quantum-desktop/Cargo.lock | 62 +++-- wai/wai-rs/Cargo.lock | 367 ++++++++++++++++++++++------- wai/wai-rs/Cargo.toml | 2 +- 5 files changed, 350 insertions(+), 129 deletions(-) diff --git a/scripts/check-advisories.py b/scripts/check-advisories.py index a8d0634b6..e53764fb6 100755 --- a/scripts/check-advisories.py +++ b/scripts/check-advisories.py @@ -84,13 +84,32 @@ ALLOW = { # ── Unreachable here ──────────────────────────────────────────────────── # All three are faults in `extract()`: SUID/SGID bits preserved from the # archive, symlinks whose targets escape the destination, and permissions - # applied through those symlinks. Nothing in this tree extracts an archive - # — there is no `ZipArchive` or `ZipStreamReader` call site. zip arrives - # under candle-core and the wasm toolchain. - "RUSTSEC-2026-0367": "zip: extract-only; nothing here extracts an archive", - "RUSTSEC-2026-0368": "zip: extract-only; nothing here extracts an archive", - "RUSTSEC-2026-0369": "zip: extract-only; nothing here extracts an archive", - "RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here extracts", + # applied through those symlinks. Nothing that runs in this tree extracts an + # archive, and no crate here calls zip directly. The one call left in the + # graph is a build script's, on its own download; RUSTSEC-2026-0429 below + # names it. + "RUSTSEC-2026-0367": "zip: extract-only; nothing here that runs extracts an archive", + "RUSTSEC-2026-0368": "zip: extract-only; nothing here that runs extracts an archive", + "RUSTSEC-2026-0369": "zip: extract-only; nothing here that runs extracts an archive", + "RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here that runs extracts", + # `ZipArchive::extract` sizes a symlink target's buffer from the size the + # archive declares, so a 112-byte archive aborts the process. Fixed in 9.0.0, + # which wai-rs and wai-quantum-desktop take. The copies left, by call site: + # + # aac-rs, 8.6.0: open_board_format 0.1.1 is its newest release and asks for + # ^8.6. It unpacks a board with `by_index` and `read_to_end`. + # jouleclaw-rs, 1.1.4, and openpay, 1.3.1: candle-core 0.8.4 reads npz and + # pth weights by name. burn 0.17 holds openpay's copy there. + # jouledesk-rs, 0.6.6: webrtc-sys-build 0.3.18 does call `extract`, in a + # build script, on the libwebrtc archive it downloads itself. The worst + # this does is abort a build. The crate's next releases change which + # libwebrtc it downloads, so it moves with livekit, not alone. + # + # Version-pinned, so a copy at any other version fails the run and is read. + "RUSTSEC-2026-0429": { + "why": "zip: extract-only abort; three copies never extract, the fourth is a build script on its own download", + "only": ("zip 8.6.0", "zip 1.1.4", "zip 1.3.1", "zip 0.6.6"), + }, # The Marvin attack recovers an RSA key from the timing of **private-key # decryption** (PKCS#1 v1.5). There is no fixed release of `rsa` at all, so # this one cannot be bumped away and the reason has to carry it. Both @@ -149,12 +168,9 @@ ALLOW = { # What bounds it: a timing attack of this class recovers a key by observing # many operations under the *same* secret, and none of our own signing runs # through this crate. WAI, sandbox and jouleclaw sign with Ed25519 - # (`ed25519_dalek` / curve25519-dalek, which does not use crypto-bigint); - # in wai-rs the elliptic-curve path arrives under `c2pa`, optional and off - # by default, where production callers supply their own signer and the - # in-tree `EphemeralSigner` holds a per-call key that reaches - # `ValidationState::Valid` and never `Trusted`. So the debt is real but it - # is not sitting under a long-lived key of ours. + # (`ed25519_dalek` / curve25519-dalek, which does not use crypto-bigint), + # and wai-rs holds no 0.5.5 copy since `c2pa` 0.91 took elliptic-curve 0.14. + # So the debt is real but it is not sitting under a long-lived key of ours. # # Version-pinned on purpose: a 0.7.x copy must never be excused by it. "RUSTSEC-2026-0387": { diff --git a/wai/CHANGELOG.md b/wai/CHANGELOG.md index b53c90218..7d7fc481f 100644 --- a/wai/CHANGELOG.md +++ b/wai/CHANGELOG.md @@ -6,6 +6,12 @@ wire format may change and such changes are recorded here. ## Unreleased +### `c2pa` 0.91 + +- **`c2pa` 0.90 → 0.91** behind `c2pa_emit`, off by default. It takes `zip` 9, past RUSTSEC-2026-0429 (which `c2pa` + never reached: it does not call `extract`), and `elliptic-curve` 0.14, which leaves no `crypto-bigint` 0.5 in this + workspace. A caller that passes its own `c2pa::Signer` builds against 0.91. + ### The route record states what a hop delivered by its count and root, so a hop may deliver any number of objects - **Route record version 3** ([extensions/route-record.md](extensions/route-record.md) §3.4, §5.2, §6, §6.1), on a diff --git a/wai/wai-quantum-desktop/Cargo.lock b/wai/wai-quantum-desktop/Cargo.lock index 44ccf44fb..26fa2efdf 100644 --- a/wai/wai-quantum-desktop/Cargo.lock +++ b/wai/wai-quantum-desktop/Cargo.lock @@ -97,15 +97,6 @@ version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" -[[package]] -name = "arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arrayvec" version = "0.7.8" @@ -400,6 +391,12 @@ version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" +[[package]] +name = "cfg_aliases" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" + [[package]] name = "chrono" version = "0.4.45" @@ -772,17 +769,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "derive_arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac" -dependencies = [ - "proc-macro2", - "quote", - "syn 3.0.9", -] - [[package]] name = "derive_more" version = "2.1.1" @@ -1328,8 +1314,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 6.0.0", + "wasm-bindgen", ] [[package]] @@ -2224,6 +2212,18 @@ version = "1.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" +[[package]] +name = "nix" +version = "0.31.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" +dependencies = [ + "bitflags 2.13.2", + "cfg-if", + "cfg_aliases", + "libc", +] + [[package]] name = "num-conv" version = "0.2.2" @@ -3827,11 +3827,11 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" -version = "2.14.0" +version = "2.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7259989d4fe11b2bf51f7d671642249b1837c4ae2da1430dc713ae38f98ceeec" +checksum = "d957abbcb3f9f6c76d22a3a0f012f30880640d0bccb5634d2b12a9937e4c872b" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "dirs", "flate2", "futures-util", @@ -4302,6 +4302,12 @@ version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" +[[package]] +name = "typed-path" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e" + [[package]] name = "typeid" version = "1.0.3" @@ -5256,14 +5262,18 @@ dependencies = [ [[package]] name = "zip" -version = "4.6.1" +version = "9.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1" +checksum = "e408c6cc4699dd017d53dc080cd51c2cea2b5354af57a1479bd265ed42911487" dependencies = [ - "arbitrary", "crc32fast", + "getrandom 0.4.3", "indexmap 2.14.2", + "libc", "memchr", + "nix", + "typed-path", + "windows-sys 0.61.2", ] [[package]] diff --git a/wai/wai-rs/Cargo.lock b/wai/wai-rs/Cargo.lock index 521fd30fe..4e5bc030b 100644 --- a/wai/wai-rs/Cargo.lock +++ b/wai/wai-rs/Cargo.lock @@ -308,9 +308,9 @@ dependencies = [ [[package]] name = "base16ct" -version = "0.2.0" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" +checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6" [[package]] name = "base64" @@ -582,32 +582,32 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04" [[package]] name = "c2pa" -version = "0.90.18" +version = "0.91.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3dc371ad12a753154b5ba21977ad62d4198539f11ceeeb1c0a47c1ab333732d" +checksum = "f258d5bfe6465d1a5c570d32b70a261f35e4e45a753e7122a88d3ba0472999b0" dependencies = [ "asn1-rs", "async-generic", "async-trait", "atree", - "base64 0.22.1", + "base64 0.23.1", "bcder", "brotli", "byteorder", "byteordered", "bytes", "c2pa_cbor", + "c2pa_raw_crypto", "chrono", "console_log", "const-hex", - "const-oid 0.9.6", "coset", - "der 0.7.10", - "ecdsa", - "ed25519-dalek", + "der 0.8.2", + "ed25519-dalek 2.2.0", "extfmt", "getrandom 0.2.17", "getrandom 0.3.4", + "getrandom 0.4.3", "glob", "hex", "http", @@ -622,16 +622,11 @@ dependencies = [ "nom 7.1.3", "non-empty-string", "nonempty-collections", - "num-bigint-dig", - "p256", - "p384", - "p521", "pem", - "pkcs1", "pkcs8 0.10.2", "png_pong", "quick-xml", - "rand 0.8.8", + "rand 0.10.3", "rand_chacha 0.9.0", "range-set", "rasn", @@ -640,7 +635,6 @@ dependencies = [ "rasn-pkix", "regex", "riff", - "rsa", "serde", "serde-transcode", "serde-wasm-bindgen", @@ -650,7 +644,6 @@ dependencies = [ "serde_with", "sha1", "sha2 0.11.0", - "spki 0.7.3", "static-iref", "tempfile", "thiserror 2.0.20", @@ -668,15 +661,40 @@ dependencies = [ [[package]] name = "c2pa_cbor" -version = "0.77.3" +version = "0.78.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b057a673824daf7a5bff38680744d7a082b61edc012c8a6dc0ebfc04c79a08c" +checksum = "e01bb497b44608f2ab1d3afb1408ca57a703c52151dff87cbe035a2e54286330" dependencies = [ "half", "serde", "serde_bytes", ] +[[package]] +name = "c2pa_raw_crypto" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38287179bf40cb58a3fafef09ee121b7221d560a76bb6b672742445a2c8db08d" +dependencies = [ + "const-hex", + "ecdsa", + "ed25519-dalek 3.0.0", + "getrandom 0.2.17", + "getrandom 0.4.3", + "p256", + "p384", + "p521", + "pkcs1", + "pkcs8 0.10.2", + "rand 0.8.8", + "rsa", + "serde", + "sha2 0.11.0", + "spki 0.7.3", + "thiserror 2.0.20", + "zeroize", +] + [[package]] name = "cbindgen" version = "0.29.4" @@ -738,6 +756,17 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" +[[package]] +name = "chacha20" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core 0.10.1", +] + [[package]] name = "chrono" version = "0.4.45" @@ -898,6 +927,12 @@ dependencies = [ "ciborium-io", ] +[[package]] +name = "cpubits" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae" + [[package]] name = "cpufeatures" version = "0.2.17" @@ -958,12 +993,16 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" [[package]] name = "crypto-bigint" -version = "0.5.5" +version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" +checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11" dependencies = [ - "generic-array", - "rand_core 0.6.4", + "cpubits", + "ctutils", + "getrandom 0.4.3", + "hybrid-array", + "num-traits", + "rand_core 0.10.1", "subtle", "zeroize", ] @@ -984,7 +1023,9 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ + "getrandom 0.4.3", "hybrid-array", + "rand_core 0.10.1", ] [[package]] @@ -998,11 +1039,12 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.4" +version = "0.4.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865" +checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a" dependencies = [ "cmov", + "subtle", ] [[package]] @@ -1015,7 +1057,23 @@ dependencies = [ "cpufeatures 0.2.17", "curve25519-dalek-derive", "digest 0.10.7", - "fiat-crypto", + "fiat-crypto 0.2.9", + "rustc_version", + "subtle", + "zeroize", +] + +[[package]] +name = "curve25519-dalek" +version = "5.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "curve25519-dalek-derive", + "digest 0.11.3", + "fiat-crypto 0.3.0", "rustc_version", "subtle", "zeroize", @@ -1177,7 +1235,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" dependencies = [ "const-oid 0.9.6", - "pem-rfc7468", + "pem-rfc7468 0.7.0", "zeroize", ] @@ -1188,6 +1246,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a" dependencies = [ "const-oid 0.10.2", + "pem-rfc7468 1.0.0", "zeroize", ] @@ -1235,6 +1294,7 @@ dependencies = [ "block-buffer 0.12.1", "const-oid 0.10.2", "crypto-common 0.2.2", + "ctutils", ] [[package]] @@ -1275,17 +1335,17 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" [[package]] name = "ecdsa" -version = "0.16.9" +version = "0.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" +checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0" dependencies = [ - "der 0.7.10", - "digest 0.10.7", + "der 0.8.2", + "digest 0.11.3", "elliptic-curve", "rfc6979", - "sha2 0.10.9", - "signature 2.2.0", - "spki 0.7.3", + "signature 3.0.0", + "spki 0.8.1", + "zeroize", ] [[package]] @@ -1298,14 +1358,24 @@ dependencies = [ "signature 2.2.0", ] +[[package]] +name = "ed25519" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a" +dependencies = [ + "pkcs8 0.11.0", + "signature 3.0.0", +] + [[package]] name = "ed25519-dalek" version = "2.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" dependencies = [ - "curve25519-dalek", - "ed25519", + "curve25519-dalek 4.1.3", + "ed25519 2.2.3", "rand_core 0.6.4", "serde", "sha2 0.10.9", @@ -1314,6 +1384,21 @@ dependencies = [ "zeroize", ] +[[package]] +name = "ed25519-dalek" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de" +dependencies = [ + "curve25519-dalek 5.0.0", + "ed25519 3.0.0", + "serde", + "sha2 0.11.0", + "signature 3.0.0", + "subtle", + "zeroize", +] + [[package]] name = "either" version = "1.18.0" @@ -1322,20 +1407,20 @@ checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" [[package]] name = "elliptic-curve" -version = "0.13.8" +version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" +checksum = "900f37e7e18d74a2347389af6cd69e3a30d5cc9e697f40004865679aa75e9c7c" dependencies = [ "base16ct", "crypto-bigint", - "digest 0.10.7", + "crypto-common 0.2.2", + "digest 0.11.3", "ff", - "generic-array", "group", - "hkdf", - "pem-rfc7468", - "pkcs8 0.10.2", - "rand_core 0.6.4", + "hybrid-array", + "pem-rfc7468 1.0.0", + "pkcs8 0.11.0", + "rand_core 0.10.1", "sec1", "subtle", "zeroize", @@ -1400,11 +1485,11 @@ dependencies = [ [[package]] name = "ff" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393" +checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f" dependencies = [ - "rand_core 0.6.4", + "rand_core 0.10.1", "subtle", ] @@ -1414,6 +1499,12 @@ version = "0.2.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" +[[package]] +name = "fiat-crypto" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24" + [[package]] name = "find-msvc-tools" version = "0.1.11" @@ -1498,7 +1589,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", - "zeroize", ] [[package]] @@ -1535,8 +1625,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 6.0.0", + "rand_core 0.10.1", + "wasm-bindgen", ] [[package]] @@ -1571,12 +1664,12 @@ dependencies = [ [[package]] name = "group" -version = "0.13.0" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" +checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4" dependencies = [ "ff", - "rand_core 0.6.4", + "rand_core 0.10.1", "subtle", ] @@ -1642,7 +1735,7 @@ version = "0.12.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" dependencies = [ - "hmac", + "hmac 0.12.1", ] [[package]] @@ -1654,6 +1747,15 @@ dependencies = [ "digest 0.10.7", ] +[[package]] +name = "hmac" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" +dependencies = [ + "digest 0.11.3", +] + [[package]] name = "hmac-sha256" version = "1.1.14" @@ -1683,7 +1785,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b" dependencies = [ "ctutils", + "subtle", "typenum", + "zeroize", ] [[package]] @@ -1795,9 +1899,9 @@ dependencies = [ [[package]] name = "id3" -version = "1.17.1" +version = "1.17.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24993fcabcbc07c8ac076a8e62db8593d1a5c4dbe81d57e531d2b7cb7f737380" +checksum = "ef8be496a46468ba3d43690775aa3a79102ce4daf7d99e8072589aae1a3cd955" dependencies = [ "bitflags 2.13.1", "byteorder", @@ -2106,7 +2210,7 @@ name = "joule-ui-interaction" version = "0.1.0" dependencies = [ "blake3", - "ed25519-dalek", + "ed25519-dalek 2.2.0", "serde", "serde_json", "thiserror 2.0.20", @@ -2448,6 +2552,18 @@ version = "1.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" +[[package]] +name = "nix" +version = "0.31.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" +dependencies = [ + "bitflags 2.13.1", + "cfg-if", + "cfg_aliases", + "libc", +] + [[package]] name = "no_std_io2" version = "0.9.4" @@ -2523,7 +2639,6 @@ dependencies = [ "num-iter", "num-traits", "rand 0.8.8", - "serde", "smallvec", "zeroize", ] @@ -2760,40 +2875,43 @@ dependencies = [ [[package]] name = "p256" -version = "0.13.2" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" +checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a" dependencies = [ "ecdsa", "elliptic-curve", + "primefield", "primeorder", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] name = "p384" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" +checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f" dependencies = [ "ecdsa", "elliptic-curve", + "fiat-crypto 0.3.0", + "primefield", "primeorder", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] name = "p521" -version = "0.13.3" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2" +checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449" dependencies = [ "base16ct", "ecdsa", "elliptic-curve", + "primefield", "primeorder", - "rand_core 0.6.4", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -2852,11 +2970,11 @@ dependencies = [ [[package]] name = "pem" -version = "3.0.6" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be" +checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "serde_core", ] @@ -2869,6 +2987,15 @@ dependencies = [ "base64ct", ] +[[package]] +name = "pem-rfc7468" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9" +dependencies = [ + "base64ct", +] + [[package]] name = "percent-encoding" version = "2.3.2" @@ -3018,12 +3145,30 @@ dependencies = [ ] [[package]] -name = "primeorder" -version = "0.13.6" +name = "primefield" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" +checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4" +dependencies = [ + "crypto-bigint", + "crypto-common 0.2.2", + "ff", + "rand_core 0.10.1", + "subtle", + "zeroize", +] + +[[package]] +name = "primeorder" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06" dependencies = [ "elliptic-curve", + "once_cell", + "primefield", + "serdect", + "wnaf", ] [[package]] @@ -3162,6 +3307,17 @@ dependencies = [ "rand_core 0.9.5", ] +[[package]] +name = "rand" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" +dependencies = [ + "chacha20", + "getrandom 0.4.3", + "rand_core 0.10.1", +] + [[package]] name = "rand_chacha" version = "0.3.1" @@ -3200,6 +3356,12 @@ dependencies = [ "getrandom 0.3.4", ] +[[package]] +name = "rand_core" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + [[package]] name = "rand_xorshift" version = "0.4.0" @@ -3467,12 +3629,12 @@ checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832" [[package]] name = "rfc6979" -version = "0.4.0" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" +checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b" dependencies = [ - "hmac", - "subtle", + "crypto-bigint", + "hmac 0.13.0", ] [[package]] @@ -3689,14 +3851,14 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" [[package]] name = "sec1" -version = "0.7.3" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" +checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d" dependencies = [ "base16ct", - "der 0.7.10", - "generic-array", - "pkcs8 0.10.2", + "ctutils", + "der 0.8.2", + "hybrid-array", "subtle", "zeroize", ] @@ -3846,6 +4008,16 @@ dependencies = [ "syn 2.0.119", ] +[[package]] +name = "serdect" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e" +dependencies = [ + "base16ct", + "serde", +] + [[package]] name = "sha1" version = "0.11.0" @@ -3923,6 +4095,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5" dependencies = [ "digest 0.11.3", + "rand_core 0.10.1", ] [[package]] @@ -4377,9 +4550,9 @@ dependencies = [ [[package]] name = "typed-path" -version = "0.12.3" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" +checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e" [[package]] name = "typenum" @@ -4525,9 +4698,9 @@ dependencies = [ "c2pa", "cbindgen", "claxon", - "curve25519-dalek", + "curve25519-dalek 4.1.3", "dav1d", - "ed25519-dalek", + "ed25519-dalek 2.2.0", "flac-bound", "getrandom 0.3.4", "hkdf", @@ -4564,7 +4737,7 @@ name = "wai-app" version = "0.1.0" dependencies = [ "bs58", - "ed25519-dalek", + "ed25519-dalek 2.2.0", "joule-ui-core", "joule-ui-interaction", "joule-ui-lang", @@ -4590,7 +4763,7 @@ name = "wai-quantum" version = "0.8.0" dependencies = [ "blake3", - "ed25519-dalek", + "ed25519-dalek 2.2.0", "serde", "serde_json", "wgpu", @@ -5108,6 +5281,18 @@ version = "0.57.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" +[[package]] +name = "wnaf" +version = "0.14.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa" +dependencies = [ + "ff", + "group", + "hybrid-array", + "primefield", +] + [[package]] name = "writeable" version = "0.6.4" @@ -5280,14 +5465,18 @@ dependencies = [ [[package]] name = "zip" -version = "8.6.0" +version = "9.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +checksum = "e408c6cc4699dd017d53dc080cd51c2cea2b5354af57a1479bd265ed42911487" dependencies = [ "crc32fast", + "getrandom 0.4.3", "indexmap 2.14.0", + "libc", "memchr", + "nix", "typed-path", + "windows-sys 0.61.2", ] [[package]] diff --git a/wai/wai-rs/Cargo.toml b/wai/wai-rs/Cargo.toml index bea715e8e..f7d008a10 100644 --- a/wai/wai-rs/Cargo.toml +++ b/wai/wai-rs/Cargo.toml @@ -85,7 +85,7 @@ sha2 = "0.10" # Writes an actual signed manifest carrying the energy + reconstruction # bindings, rather than only defining their shapes. Off by default: the SDK # is a large dependency chain and most consumers only need the types. -c2pa = { version = "0.90", optional = true, default-features = false, features = ["rust_native_crypto"] } +c2pa = { version = "0.91", optional = true, default-features = false, features = ["rust_native_crypto"] } # ---- interactive worlds (optional, behind the `world` feature) ---- # extensions/interactive-worlds: WWLD container, signed CausalOps, -- 2.54.0 (Apple Git-157)