trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-01 07:53:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): resolve RustSec advisories and restore cargo-deny (#5030)

Browse Source 
* fix(deps): resolve RustSec advisories and restore cargo-deny

Signed-off-by: Adrien Langou <alangou@nvidia.com>

* chore(deps): use zstd 0.14 requirement

Signed-off-by: Adrien Langou <alangou@nvidia.com>

---------

Signed-off-by: Adrien Langou <alangou@nvidia.com>
This commit is contained in:
alangou
2026-10-29 15:46:55 +00:00
committed by GitHub
parent 4d4c15c133
commit 077d43131e
40 changed files with 269 additions and 475 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+57 -284
View File
@@ -144,9 +144,9 @@ dependencies = [
[[package]]
name = "anyhow"
version = "1.0.102"
version = "1.0.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
[[package]]
name = "apollo-parser"
@@ -766,12 +766,6 @@ dependencies = [
"backtrace",
]
[[package]]
name = "base16ct"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
[[package]]
name = "base16ct"
version = "1.0.0"
@@ -1377,9 +1371,9 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
version = "0.9.18"
version = "0.9.21"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
dependencies = [
"crossbeam-utils",
]
@@ -1442,18 +1436,6 @@ dependencies = [
"winapi",
]
[[package]]
name = "crypto-bigint"
version = "0.5.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
dependencies = [
"generic-array 0.14.7",
"rand_core 0.6.4",
"subtle",
"zeroize",
]
[[package]]
name = "crypto-bigint"
version = "0.7.10"
@@ -1498,7 +1480,7 @@ version = "0.7.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
dependencies = [
"crypto-bigint 0.7.10",
"crypto-bigint",
"rand_core 0.10.1",
]
@@ -1531,22 +1513,6 @@ dependencies = [
"subtle",
]
[[package]]
name = "curve25519-dalek"
version = "4.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
dependencies = [
"cfg-if",
"cpufeatures 0.2.17",
"curve25519-dalek-derive",
"digest 0.10.7",
"fiat-crypto 0.2.9",
"rustc_version",
"subtle",
"zeroize",
]
[[package]]
name = "curve25519-dalek"
version = "5.0.0"
@@ -1557,7 +1523,7 @@ dependencies = [
"cpufeatures 0.3.0",
"curve25519-dalek-derive",
"digest 0.11.2",
"fiat-crypto 0.3.0",
"fiat-crypto",
"rand_core 0.10.1",
"rustc_version",
"subtle",
@@ -1902,20 +1868,6 @@ version = "1.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
[[package]]
name = "ecdsa"
version = "0.16.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
dependencies = [
"der 0.7.10",
"digest 0.10.7",
"elliptic-curve 0.13.8",
"rfc6979 0.4.0",
"signature 2.2.0",
"spki 0.7.3",
]
[[package]]
name = "ecdsa"
version = "0.17.0"
@@ -1924,23 +1876,13 @@ checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
dependencies = [
"der 0.8.2",
"digest 0.11.2",
"elliptic-curve 0.14.1",
"rfc6979 0.6.0",
"elliptic-curve",
"rfc6979",
"signature 3.0.0",
"spki 0.8.0",
"zeroize",
]
[[package]]
name = "ed25519"
version = "2.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
dependencies = [
"pkcs8 0.10.2",
"signature 2.2.0",
]
[[package]]
name = "ed25519"
version = "3.0.0"
@@ -1951,28 +1893,14 @@ dependencies = [
"signature 3.0.0",
]
[[package]]
name = "ed25519-dalek"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
dependencies = [
"curve25519-dalek 4.1.3",
"ed25519 2.2.3",
"serde",
"sha2 0.10.9",
"subtle",
"zeroize",
]
[[package]]
name = "ed25519-dalek"
version = "3.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
dependencies = [
"curve25519-dalek 5.0.0",
"ed25519 3.0.0",
"curve25519-dalek",
"ed25519",
"rand_core 0.10.1",
"serde",
"sha2 0.11.0",
@@ -2002,45 +1930,24 @@ dependencies = [
"serde",
]
[[package]]
name = "elliptic-curve"
version = "0.13.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
dependencies = [
"base16ct 0.2.0",
"crypto-bigint 0.5.5",
"digest 0.10.7",
"ff 0.13.1",
"generic-array 0.14.7",
"group 0.13.0",
"hkdf 0.12.4",
"pem-rfc7468 0.7.0",
"pkcs8 0.10.2",
"rand_core 0.6.4",
"sec1 0.7.3",
"subtle",
"zeroize",
]
[[package]]
name = "elliptic-curve"
version = "0.14.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
dependencies = [
"base16ct 1.0.0",
"crypto-bigint 0.7.10",
"base16ct",
"crypto-bigint",
"crypto-common 0.2.2",
"digest 0.11.2",
"ff 0.14.0",
"group 0.14.0",
"hkdf 0.13.0",
"ff",
"group",
"hkdf",
"hybrid-array",
"pem-rfc7468 1.0.0",
"pkcs8 0.11.0",
"rand_core 0.10.1",
"sec1 0.8.1",
"sec1",
"subtle",
"zeroize",
]
@@ -2195,16 +2102,6 @@ version = "2.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
[[package]]
name = "ff"
version = "0.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
dependencies = [
"rand_core 0.6.4",
"subtle",
]
[[package]]
name = "ff"
version = "0.14.0"
@@ -2215,12 +2112,6 @@ dependencies = [
"subtle",
]
[[package]]
name = "fiat-crypto"
version = "0.2.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
[[package]]
name = "fiat-crypto"
version = "0.3.0"
@@ -2465,7 +2356,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
dependencies = [
"typenum",
"version_check",
"zeroize",
]
[[package]]
@@ -2591,24 +2481,13 @@ dependencies = [
"wasm-bindgen",
]
[[package]]
name = "group"
version = "0.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
dependencies = [
"ff 0.13.1",
"rand_core 0.6.4",
"subtle",
]
[[package]]
name = "group"
version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
dependencies = [
"ff 0.14.0",
"ff",
"rand_core 0.10.1",
"subtle",
]
@@ -2747,15 +2626,6 @@ dependencies = [
"url",
]
[[package]]
name = "hkdf"
version = "0.12.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
dependencies = [
"hmac 0.12.1",
]
[[package]]
name = "hkdf"
version = "0.13.0"
@@ -3505,18 +3375,11 @@ checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
dependencies = [
"aws-lc-rs",
"base64 0.22.1",
"ed25519-dalek 2.2.0",
"getrandom 0.2.17",
"hmac 0.12.1",
"js-sys",
"p256 0.13.2",
"p384 0.13.1",
"pem 3.0.6",
"rand 0.8.6",
"rsa 0.9.10",
"serde",
"serde_json",
"sha2 0.10.9",
"signature 2.2.0",
"simple_asn1",
]
@@ -4511,7 +4374,6 @@ dependencies = [
"rcgen",
"reqwest 0.12.28",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"tar",
@@ -4562,7 +4424,6 @@ dependencies = [
"reqwest 0.12.28",
"rustix 1.1.4",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -4858,7 +4719,7 @@ dependencies = [
"tracing-opentelemetry",
"tracing-subscriber",
"url",
"zstd 0.13.3",
"zstd",
]
[[package]]
@@ -5097,7 +4958,6 @@ dependencies = [
"russh-sftp",
"rustix 1.1.4",
"rustls",
"rustls-pemfile",
"seccompiler",
"serde",
"serde_json",
@@ -5131,7 +4991,6 @@ dependencies = [
"rcgen",
"rustix 1.1.4",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"socket2",
@@ -5244,7 +5103,6 @@ dependencies = [
"russh",
"rustix 1.1.4",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -5420,7 +5278,6 @@ dependencies = [
"rustix 1.1.4",
"rustls",
"rustls-native-certs",
"rustls-pemfile",
"serde",
"serde_json",
"sha1 0.10.6",
@@ -5617,54 +5474,30 @@ version = "4.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
[[package]]
name = "p256"
version = "0.13.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
dependencies = [
"ecdsa 0.16.9",
"elliptic-curve 0.13.8",
"primeorder 0.13.6",
"sha2 0.10.9",
]
[[package]]
name = "p256"
version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
dependencies = [
"ecdsa 0.17.0",
"elliptic-curve 0.14.1",
"ecdsa",
"elliptic-curve",
"primefield",
"primeorder 0.14.0",
"primeorder",
"sha2 0.11.0",
]
[[package]]
name = "p384"
version = "0.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
dependencies = [
"ecdsa 0.16.9",
"elliptic-curve 0.13.8",
"primeorder 0.13.6",
"sha2 0.10.9",
]
[[package]]
name = "p384"
version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
dependencies = [
"ecdsa 0.17.0",
"elliptic-curve 0.14.1",
"fiat-crypto 0.3.0",
"ecdsa",
"elliptic-curve",
"fiat-crypto",
"primefield",
"primeorder 0.14.0",
"primeorder",
"sha2 0.11.0",
]
@@ -5674,11 +5507,11 @@ version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
dependencies = [
"base16ct 1.0.0",
"ecdsa 0.17.0",
"elliptic-curve 0.14.1",
"base16ct",
"ecdsa",
"elliptic-curve",
"primefield",
"primeorder 0.14.0",
"primeorder",
"sha2 0.11.0",
]
@@ -5688,7 +5521,7 @@ version = "0.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6d8eab09a361a4afe0b1668be978cd97e4f052e927a92b0b608cf902965d49ce"
dependencies = [
"base16ct 1.0.0",
"base16ct",
"byteorder",
"bytes",
"delegate",
@@ -6149,30 +5982,21 @@ version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
dependencies = [
"crypto-bigint 0.7.10",
"crypto-bigint",
"crypto-common 0.2.2",
"ff 0.14.0",
"ff",
"rand_core 0.10.1",
"subtle",
"zeroize",
]
[[package]]
name = "primeorder"
version = "0.13.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
dependencies = [
"elliptic-curve 0.13.8",
]
[[package]]
name = "primeorder"
version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
dependencies = [
"elliptic-curve 0.14.1",
"elliptic-curve",
"once_cell",
"primefield",
"serdect",
@@ -6342,9 +6166,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
[[package]]
name = "pulldown-cmark"
version = "0.13.3"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags 2.13.2",
"memchr",
@@ -6852,23 +6676,13 @@ dependencies = [
"web-sys",
]
[[package]]
name = "rfc6979"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
dependencies = [
"hmac 0.12.1",
"subtle",
]
[[package]]
name = "rfc6979"
version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
dependencies = [
"crypto-bigint 0.7.10",
"crypto-bigint",
"hmac 0.13.0",
]
@@ -6925,7 +6739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
dependencies = [
"const-oid 0.10.2",
"crypto-bigint 0.7.10",
"crypto-bigint",
"crypto-primes",
"digest 0.11.2",
"pkcs1 0.8.0-rc.4",
@@ -6951,16 +6765,16 @@ dependencies = [
"bytes",
"cbc",
"cipher",
"crypto-bigint 0.7.10",
"crypto-bigint",
"ctr",
"curve25519-dalek 5.0.0",
"curve25519-dalek",
"data-encoding",
"delegate",
"der 0.8.2",
"digest 0.11.2",
"ecdsa 0.17.0",
"ed25519-dalek 3.0.0",
"elliptic-curve 0.14.1",
"ecdsa",
"ed25519-dalek",
"elliptic-curve",
"enum_dispatch",
"flate2",
"futures",
@@ -6976,8 +6790,8 @@ dependencies = [
"ml-kem",
"module-lattice",
"num-bigint 0.5.1",
"p256 0.14.0",
"p384 0.14.0",
"p256",
"p384",
"p521",
"pageant",
"pbkdf2",
@@ -6992,7 +6806,7 @@ dependencies = [
"russh-util",
"salsa20",
"scrypt",
"sec1 0.8.1",
"sec1",
"sha1 0.11.0",
"sha2 0.11.0",
"sha3 0.12.0",
@@ -7142,15 +6956,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.14.0"
@@ -7282,27 +7087,13 @@ dependencies = [
"sha2 0.11.0",
]
[[package]]
name = "sec1"
version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
dependencies = [
"base16ct 0.2.0",
"der 0.7.10",
"generic-array 0.14.7",
"pkcs8 0.10.2",
"subtle",
"zeroize",
]
[[package]]
name = "sec1"
version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
dependencies = [
"base16ct 1.0.0",
"base16ct",
"ctutils",
"der 0.8.2",
"hybrid-array",
@@ -7494,7 +7285,7 @@ version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9af4a3e75ebd5599b30d4de5768e00b5095d518a79fefc3ecbaf77e665d1ec06"
dependencies = [
"base16ct 1.0.0",
"base16ct",
"serde",
]
@@ -7907,7 +7698,7 @@ dependencies = [
"futures-core",
"futures-util",
"hex",
"hkdf 0.13.0",
"hkdf",
"hmac 0.13.0",
"itoa",
"log",
@@ -7975,7 +7766,7 @@ checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e"
dependencies = [
"base64ct",
"bytes",
"crypto-bigint 0.7.10",
"crypto-bigint",
"ctutils",
"digest 0.11.2",
"pem-rfc7468 1.0.0",
@@ -7991,15 +7782,15 @@ dependencies = [
"argon2",
"bcrypt-pbkdf",
"ctutils",
"ed25519-dalek 3.0.0",
"ed25519-dalek",
"hex",
"hmac 0.13.0",
"p256 0.14.0",
"p384 0.14.0",
"p256",
"p384",
"p521",
"rand_core 0.10.1",
"rsa 0.10.0-rc.18",
"sec1 0.8.1",
"sec1",
"sha1 0.11.0",
"sha2 0.11.0",
"signature 3.0.0",
@@ -9854,8 +9645,8 @@ version = "0.14.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
dependencies = [
"ff 0.14.0",
"group 0.14.0",
"ff",
"group",
"hybrid-array",
"primefield",
]
@@ -10108,7 +9899,7 @@ dependencies = [
"windows-sys 0.61.2",
"zeroize",
"zopfli",
"zstd 0.14.3",
"zstd",
]
[[package]]
@@ -10135,31 +9926,13 @@ dependencies = [
"simd-adler32",
]
[[package]]
name = "zstd"
version = "0.13.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
dependencies = [
"zstd-safe 7.2.4",
]
[[package]]
name = "zstd"
version = "0.14.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
dependencies = [
"zstd-safe 8.2.0",
]
[[package]]
name = "zstd-safe"
version = "7.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
dependencies = [
"zstd-sys",
"zstd-safe",
]
[[package]]
Cargo.toml
+1 -2
View File
@@ -42,7 +42,6 @@ h2 = "0.4"
# TLS
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12"] }
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12"] }
rustls-pemfile = "2"
rcgen = { version = "0.14.10", default-features = false, features = ["pem"] }
webpki-roots = "1"
rustls-native-certs = "0.8"
@@ -117,7 +116,7 @@ jsonwebtoken = { version = "10", default-features = false, features = ["use_pem"
zeroize = { version = "1", features = ["derive"] }
getrandom = "0.3"
aws-lc-rs = "1.16"
spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "jwt-verify-rust-crypto", "tracing"] }
spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "jwt-verify-aws-lc-rs", "tracing"] }
# Filesystem embedding
include_dir = "0.7"
crates/openshell-cli/Cargo.toml
-1
View File
@@ -53,7 +53,6 @@ hyper = { workspace = true }
hyper-util = { workspace = true }
hyper-rustls = { version = "0.27", default-features = false, features = ["native-tokio", "http1", "http2", "tls12", "logging"] }
rustls = { workspace = true }
rustls-pemfile = { workspace = true }
reqwest = { workspace = true }
# Error handling
crates/openshell-cli/src/tls.rs
+6 -4
View File
@@ -9,7 +9,7 @@ use openshell_sdk::{AuthConfig, ClientConfig, ClientIdentity, OpenShellClient};
use rustls::{
RootCertStore,
client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime},
pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime, pem::PemObject},
};
use std::io::Cursor;
use std::path::PathBuf;
@@ -185,7 +185,9 @@ pub fn require_tls_materials(server: &str, tls: &TlsOptions) -> Result<TlsMateri
fn load_private_key(pem: &[u8]) -> Result<PrivateKeyDer<'static>> {
let mut cursor = Cursor::new(pem);
let key = rustls_pemfile::private_key(&mut cursor)
let key = PrivateKeyDer::pem_reader_iter(&mut cursor)
.next()
.transpose()
.into_diagnostic()?
.ok_or_else(|| miette::miette!("no private key found in TLS key PEM"))?;
Ok(key)
@@ -194,7 +196,7 @@ fn load_private_key(pem: &[u8]) -> Result<PrivateKeyDer<'static>> {
pub fn build_rustls_config(materials: &TlsMaterials) -> Result<rustls::ClientConfig> {
let mut roots = RootCertStore::empty();
let mut ca_cursor = Cursor::new(&materials.ca);
let ca_certs = rustls_pemfile::certs(&mut ca_cursor)
let ca_certs = CertificateDer::pem_reader_iter(&mut ca_cursor)
.collect::<Result<Vec<CertificateDer<'static>>, _>>()
.into_diagnostic()?;
for cert in ca_certs {
@@ -202,7 +204,7 @@ pub fn build_rustls_config(materials: &TlsMaterials) -> Result<rustls::ClientCon
}
let mut cert_cursor = Cursor::new(&materials.cert);
let cert_chain = rustls_pemfile::certs(&mut cert_cursor)
let cert_chain = CertificateDer::pem_reader_iter(&mut cert_cursor)
.collect::<Result<Vec<CertificateDer<'static>>, _>>()
.into_diagnostic()?;
let key = load_private_key(&materials.key)?;
crates/openshell-core/Cargo.toml
-1
View File
@@ -33,7 +33,6 @@ url = { workspace = true }
uuid = { workspace = true }
ipnet = "2"
rustls = { workspace = true }
rustls-pemfile = { workspace = true }
base64 = { workspace = true }
jsonwebtoken = { workspace = true, optional = true }
zeroize = { workspace = true, optional = true }
crates/openshell-core/src/driver_utils.rs
+4 -3
View File
@@ -3,6 +3,7 @@
//! Utility helpers shared across compute-driver crates.
use rustls::pki_types::{CertificateDer, pem::PemObject};
use std::path::{Path, PathBuf};
use crate::proto::compute::v1::DriverSandbox;
@@ -473,7 +474,7 @@ pub fn read_upstream_proxy_ca_bundle_file(path: &str, label: &str) -> Result<Str
/// Validating that rustls accepts an anchor — rather than only that PEM
/// framing base64-decodes — is what makes the host-side check equivalent to
/// the guest-side one: a PEM block holding invalid DER passes
/// `rustls_pemfile::certs` but is silently dropped by
/// `CertificateDer::pem_reader_iter` but is silently dropped by
/// `RootCertStore::add_parsable_certificates`, so counting PEM blocks alone
/// would accept on the host a bundle that contributes zero anchors at runtime.
///
@@ -486,7 +487,7 @@ pub fn validate_upstream_proxy_ca_bundle_pem(
path: &str,
label: &str,
) -> Result<(), String> {
let certs: Vec<_> = rustls_pemfile::certs(&mut pem.as_bytes())
let certs: Vec<_> = CertificateDer::pem_reader_iter(&mut pem.as_bytes())
.flatten()
.collect();
if certs.is_empty() {
@@ -1318,7 +1319,7 @@ mod tests {
#[test]
fn ca_bundle_rejects_pem_blocks_holding_invalid_der() {
// Passes `rustls_pemfile::certs` but contributes no trust anchor, so
// Passes `CertificateDer::pem_reader_iter` but contributes no trust anchor, so
// accepting it on the host would break every guest after boot.
let err = validate_upstream_proxy_ca_bundle_pem(
"-----BEGIN CERTIFICATE-----\nAQID\n-----END CERTIFICATE-----\n",
crates/openshell-core/src/grpc_client.rs
+5 -3
View File
@@ -469,7 +469,7 @@ impl Drop for ClientSpanStatus {
mod gateway_tls_isolation_tests {
use super::*;
use rcgen::{CertificateParams, IsCa};
use rustls::pki_types::{CertificateDer, PrivateKeyDer};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use std::io::Cursor;
use tokio::net::TcpListener;
use tokio_rustls::TlsAcceptor;
@@ -503,11 +503,13 @@ mod gateway_tls_isolation_tests {
}
async fn start_h2_tls_server(pki: &TestPki) -> std::net::SocketAddr {
let certificates = rustls_pemfile::certs(&mut Cursor::new(&pki.server_cert_pem))
let certificates = CertificateDer::pem_reader_iter(&mut Cursor::new(&pki.server_cert_pem))
.collect::<std::result::Result<Vec<CertificateDer<'static>>, _>>()
.unwrap();
let key: PrivateKeyDer<'static> =
rustls_pemfile::private_key(&mut Cursor::new(&pki.server_key_pem))
PrivateKeyDer::pem_reader_iter(&mut Cursor::new(&pki.server_key_pem))
.next()
.transpose()
.unwrap()
.unwrap();
let mut config = rustls::ServerConfig::builder()
crates/openshell-crypto/README.md
+2 -1
View File
@@ -110,7 +110,8 @@ rotation constraints still apply. Authentication failures expose no plaintext or
distinction between wrong keys, AAD, nonce, ciphertext, or tags.
Coverage excludes dependency-owned SSH/russh primitives, AWS SigV4 signing,
SPIFFE RustCrypto verification, and non-Rust client runtimes. AWS SDK HTTPS also
SPIFFE JWT verification, and non-Rust client runtimes. SPIFFE uses its AWS-LC
backend directly, outside the facade. AWS SDK HTTPS also
retains its dependency-owned selection. Non-security content hashes and ordinary
scheduling randomness are not migrated. No SSH or PQC capability is asserted by
the primitive capability report. OpenSSL, strict policy, module version discovery,
crates/openshell-driver-vm/Cargo.toml
+1 -1
View File
@@ -61,7 +61,7 @@ libloading = { version = "0.8", optional = true }
tar = { version = "0.4", optional = true }
flate2 = { version = "1", optional = true }
sha2 = { version = "0.10", optional = true }
zstd = { version = "0.13", optional = true }
zstd = { version = "0.14", optional = true }
[features]
# Portable test instrumentation, independent of the compute runtime.
crates/openshell-driver-vm/src/driver.rs
+22
View File
@@ -12343,6 +12343,28 @@ mod tests {
let _ = fs::remove_dir_all(base);
}
#[test]
fn extracts_zstd_compressed_oci_layer() {
let temp = tempfile::tempdir().unwrap();
let archive = tar_bytes_with_file("bin/tool", b"tool contents");
let compressed = zstd::encode_all(archive.as_slice(), 0).unwrap();
let blob = temp.path().join("layer.tar.zst");
let extracted = temp.path().join("extracted");
fs::write(&blob, compressed).unwrap();
extract_layer_blob_to_dir(
&blob,
"application/vnd.oci.image.layer.v1.tar+zstd",
&extracted,
)
.unwrap();
assert_eq!(
fs::read(extracted.join("bin/tool")).unwrap(),
b"tool contents"
);
}
#[test]
fn layer_compression_from_media_type_supports_common_formats() {
assert_eq!(
crates/openshell-sandbox-backend/Cargo.toml
-1
View File
@@ -24,7 +24,6 @@ prost = { workspace = true }
prost-types = { workspace = true }
rcgen = { workspace = true }
rustls = { workspace = true }
rustls-pemfile = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
socket2 = { workspace = true }
crates/openshell-sandbox-backend/src/runtime.rs
+10 -5
View File
@@ -28,6 +28,7 @@ use openshell_isolation_interface::contract::{
MediationTiming, PendingDnsQuery, PendingTcpOpen, ProviderEnvironmentInstallation,
ResolvedWorkloadIdentity, SandboxContext, TcpOpenDecision, TcpOpenDenial,
};
use rustls::pki_types::{CertificateDer, pem::PemObject};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
#[cfg(unix)]
use tokio::net::UnixStream;
@@ -658,7 +659,7 @@ pub fn validate_client_tls(tls: &SandboxTlsClientConfig) -> Result<(), BackendEr
fn tls_client_config(tls: &SandboxTlsClientConfig) -> Result<rustls::ClientConfig, BackendError> {
openshell_crypto::tls::ensure_default_provider();
let certificates = rustls_pemfile::certs(&mut tls.trust_anchor_pem.as_bytes())
let certificates = CertificateDer::pem_reader_iter(&mut tls.trust_anchor_pem.as_bytes())
.collect::<Result<Vec<_>, _>>()
.map_err(|error| {
BackendError::Descriptor(format!("parse boundary TLS CA certificate: {error}"))
@@ -3040,6 +3041,7 @@ mod tests {
mod protocol_errors;
use crate::isolation_protocol::exchange_frame;
use rustls::pki_types::PrivateKeyDer;
use std::path::PathBuf;
use std::pin::Pin;
use std::task::{Context, Poll};
@@ -4166,10 +4168,13 @@ mod tests {
openshell_crypto::tls::ensure_default_provider();
let material =
generate_sandbox_tls_material(test_session_id()).expect("generate test material");
let certificates = rustls_pemfile::certs(&mut material.certificate_chain_pem.as_bytes())
.collect::<Result<Vec<_>, _>>()
.expect("parse server certificate");
let private_key = rustls_pemfile::private_key(&mut material.private_key_pem.as_bytes())
let certificates =
CertificateDer::pem_reader_iter(&mut material.certificate_chain_pem.as_bytes())
.collect::<Result<Vec<_>, _>>()
.expect("parse server certificate");
let private_key = PrivateKeyDer::pem_reader_iter(&mut material.private_key_pem.as_bytes())
.next()
.transpose()
.expect("parse server private key")
.expect("server private key");
let mut server_config =
crates/openshell-sandbox-backend/src/runtime/test_support.rs
+5 -2
View File
@@ -21,6 +21,7 @@ use openshell_isolation_interface::contract::{
ProviderEnvironmentInstallation, ProvisioningEvidence, ResolvedWorkloadIdentity,
SandboxContext, TcpOpenDecision,
};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use std::collections::HashMap;
use std::pin::Pin;
use std::sync::{Arc, Mutex};
@@ -688,10 +689,12 @@ impl super::BoundaryTransportConnector for Connector {
fn client(peer: Peer) -> Arc<BoundaryClient> {
let session_id = "550e8400-e29b-41d4-a716-446655440000".parse().unwrap();
let material = w::generate_sandbox_tls_material(session_id).unwrap();
let certs = rustls_pemfile::certs(&mut material.certificate_chain_pem.as_bytes())
let certs = CertificateDer::pem_reader_iter(&mut material.certificate_chain_pem.as_bytes())
.collect::<Result<Vec<_>, _>>()
.unwrap();
let key = rustls_pemfile::private_key(&mut material.private_key_pem.as_bytes())
let key = PrivateKeyDer::pem_reader_iter(&mut material.private_key_pem.as_bytes())
.next()
.transpose()
.unwrap()
.unwrap();
let mut config = openshell_crypto::tls::server_builder()
crates/openshell-sandbox-backend/src/runtime_routed.rs
+5 -2
View File
@@ -582,6 +582,7 @@ async fn send_reply(
mod tests {
use super::*;
use crate::boundary_protocol::{SandboxTlsMaterial, generate_sandbox_tls_material};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
/// A runtime: dial the router, name `route`, and serve `identity`'s TLS.
async fn runtime_dial(
@@ -614,10 +615,12 @@ mod tests {
.unwrap()
.with_no_client_auth()
.with_single_cert(
rustls_pemfile::certs(&mut identity.certificate_chain_pem.as_bytes())
CertificateDer::pem_reader_iter(&mut identity.certificate_chain_pem.as_bytes())
.collect::<Result<Vec<_>, _>>()
.unwrap(),
rustls_pemfile::private_key(&mut identity.private_key_pem.as_bytes())
PrivateKeyDer::pem_reader_iter(&mut identity.private_key_pem.as_bytes())
.next()
.transpose()
.unwrap()
.unwrap(),
)
crates/openshell-sandbox/Cargo.toml
-1
View File
@@ -55,7 +55,6 @@ nix = { workspace = true, features = ["resource", "socket", "feature", "poll"] }
# TLS crypto provider install (main.rs)
rustls = { workspace = true }
rustls-pemfile = { workspace = true }
tokio-rustls = { workspace = true }
# Serialization (serde_json::json! for OCSF unmapped fields)
crates/openshell-sandbox/src/boundary_server.rs
+10 -4
View File
@@ -17,6 +17,7 @@ mod linux {
BoundaryExec, BoundaryLoopbackConnector, BoundaryProcess, BoundaryTerminal, ExecSession,
};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use std::fs::File;
use std::io::{self, Read, Write};
use std::mem::size_of;
@@ -5034,8 +5035,9 @@ mod linux {
) -> io::Result<rustls::ServerConfig> {
openshell_crypto::tls::ensure_default_provider();
let certificate_bytes = std::fs::read(&tls.certificate_chain_path)?;
let certificates = rustls_pemfile::certs(&mut certificate_bytes.as_slice())
.collect::<Result<Vec<_>, _>>()?;
let certificates = CertificateDer::pem_reader_iter(&mut certificate_bytes.as_slice())
.collect::<Result<Vec<_>, _>>()
.map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
if certificates.is_empty() {
return Err(io::Error::new(
io::ErrorKind::InvalidInput,
@@ -5043,7 +5045,10 @@ mod linux {
));
}
let private_key_bytes = std::fs::read(&tls.private_key_path)?;
let private_key = rustls_pemfile::private_key(&mut private_key_bytes.as_slice())?
let private_key = PrivateKeyDer::pem_reader_iter(&mut private_key_bytes.as_slice())
.next()
.transpose()
.map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?
.ok_or_else(|| {
io::Error::new(
io::ErrorKind::InvalidInput,
@@ -5558,7 +5563,8 @@ mod linux {
fn test_client_config(tls: &SandboxTlsClientConfig) -> rustls::ClientConfig {
let mut roots = rustls::RootCertStore::empty();
for certificate in rustls_pemfile::certs(&mut tls.trust_anchor_pem.as_bytes()) {
for certificate in CertificateDer::pem_reader_iter(&mut tls.trust_anchor_pem.as_bytes())
{
roots
.add(certificate.expect("parse test CA"))
.expect("add test CA");
crates/openshell-server/Cargo.toml
-1
View File
@@ -59,7 +59,6 @@ http-body-util = { workspace = true }
# TLS
tokio-rustls = { workspace = true }
rustls = { workspace = true }
rustls-pemfile = { workspace = true }
# CLI
clap = { workspace = true }
crates/openshell-server/src/auth/sandbox_jwt.rs
+5 -3
View File
@@ -24,10 +24,10 @@ pub use openshell_extension_core::{
EXTENSION_JWT_TYP, ExtensionAudience, ExtensionCallerKind, ExtensionJwtClaims,
MAX_EXTENSION_TOKEN_TTL,
};
use rustls::pki_types::pem::{PemObject, SectionKind};
use serde::Serialize;
use sha2::{Digest as _, Sha256};
use std::{
io::Cursor,
sync::Arc,
time::{Duration, SystemTime, UNIX_EPOCH},
};
@@ -534,9 +534,11 @@ impl ExtensionJwtIssuer {
impl GatewayJwks {
fn from_public_key_pem(public_key_pem: &[u8], kid: String) -> Result<Self, String> {
let item = rustls_pemfile::read_one(&mut Cursor::new(public_key_pem))
let item = <(SectionKind, Vec<u8>)>::pem_slice_iter(public_key_pem)
.next()
.transpose()
.map_err(|e| format!("failed to parse Ed25519 public key PEM for JWKS: {e}"))?;
let Some(rustls_pemfile::Item::SubjectPublicKeyInfo(der)) = item else {
let Some((SectionKind::PublicKey, der)) = item else {
return Err("Ed25519 public key PEM does not contain a PUBLIC KEY block".into());
};
let (remainder, spki) = SubjectPublicKeyInfo::from_der(der.as_ref())
crates/openshell-server/src/config_file.rs
+5 -4
View File
@@ -21,7 +21,7 @@
use std::collections::BTreeMap;
use std::fs::OpenOptions;
use std::io::{Cursor, Read as _};
use std::io::Read as _;
use std::net::SocketAddr;
use std::path::{Path, PathBuf};
@@ -33,6 +33,7 @@ use openshell_core::{
ExtensionBindingPolicy, GatewayAuthConfig, GatewayInterceptorConfig, GatewayJwtConfig,
GatewayProviderProfileSourceConfig, MtlsAuthConfig, OidcConfig,
};
use rustls::pki_types::pem::{PemObject, SectionKind};
use serde::{Deserialize, Serialize};
/// Gateway configuration schema version supported by this build.
@@ -672,13 +673,13 @@ impl TryFrom<&MiddlewareServiceFileConfig> for SupervisorMiddlewareService {
fn sanitize_ca_cert_pem(name: &str, path: &Path, pem: &[u8]) -> Result<Vec<u8>, ConfigFileError> {
let mut sanitized = Vec::new();
let mut certificate_count = 0;
for item in rustls_pemfile::read_all(&mut Cursor::new(pem)) {
for item in <(SectionKind, Vec<u8>)>::pem_slice_iter(pem) {
let item = item.map_err(|source| ConfigFileError::MiddlewareTlsCaInvalid {
name: name.to_string(),
path: path.to_path_buf(),
message: source.to_string(),
})?;
let rustls_pemfile::Item::X509Certificate(certificate) = item else {
let (SectionKind::Certificate, certificate) = item else {
return Err(ConfigFileError::MiddlewareTlsCaInvalid {
name: name.to_string(),
path: path.to_path_buf(),
@@ -687,7 +688,7 @@ fn sanitize_ca_cert_pem(name: &str, path: &Path, pem: &[u8]) -> Result<Vec<u8>,
};
certificate_count += 1;
sanitized.extend_from_slice(b"-----BEGIN CERTIFICATE-----\n");
let encoded = base64::engine::general_purpose::STANDARD.encode(certificate.as_ref());
let encoded = base64::engine::general_purpose::STANDARD.encode(&certificate);
for line in encoded.as_bytes().chunks(64) {
sanitized.extend_from_slice(line);
sanitized.push(b'\n');
crates/openshell-server/src/network_trust.rs
+9 -5
View File
@@ -11,9 +11,13 @@
use base64::Engine as _;
use openshell_core::network_trust::MAX_NETWORK_SUPERVISOR_TRUST_BUNDLE_BYTES;
use openshell_core::{Error, NetworkSupervisorTrustBundle, Result};
use rustls::pki_types::{
CertificateDer,
pem::{PemObject, SectionKind},
};
use sha2::{Digest, Sha256};
use std::fs;
use std::io::{Cursor, ErrorKind, Read, Write};
use std::io::{ErrorKind, Read, Write};
use std::path::{Path, PathBuf};
use crate::config_file::SupervisorNetworkFileSection;
@@ -166,7 +170,7 @@ fn stage_normalized_in(
}
fn normalize_source(source_path: &Path, source: &[u8]) -> Result<(Vec<u8>, usize)> {
// `rustls_pemfile` intentionally skips text outside PEM blocks. The
// Rustls's PEM parser intentionally skips text outside PEM blocks. The
// gateway contract is stricter: a configured file must not contain a
// valid subset hidden among unrelated or malformed material.
if source
@@ -177,20 +181,20 @@ fn normalize_source(source_path: &Path, source: &[u8]) -> Result<(Vec<u8>, usize
}
let mut certificates = Vec::new();
for item in rustls_pemfile::read_all(&mut Cursor::new(source)) {
for item in <(SectionKind, Vec<u8>)>::pem_slice_iter(source) {
let item = item.map_err(|error| {
config_error(
source_path,
format_args!("contains malformed PEM data: {error}"),
)
})?;
let rustls_pemfile::Item::X509Certificate(certificate) = item else {
let (SectionKind::Certificate, certificate) = item else {
return Err(config_error(
source_path,
"contains a non-certificate PEM block",
));
};
certificates.push(certificate);
certificates.push(CertificateDer::from(certificate));
}
if certificates.is_empty() {
crates/openshell-server/src/tls.rs
+7 -16
View File
@@ -16,7 +16,7 @@ use notify::{Event, RecursiveMode, Watcher};
use openshell_core::{Error, Result};
use openshell_ocsf::{ConfigStateChangeBuilder, EventContext, SeverityId, StateId, StatusId};
use rustls::ServerConfig;
use rustls::pki_types::{CertificateDer, PrivateKeyDer};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use rustls::server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier};
use rustls::sign::CertifiedKey;
use tokio::sync::{mpsc, watch};
@@ -440,7 +440,7 @@ fn load_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
File::open(path).map_err(|e| Error::tls(format!("failed to open cert file: {e}")))?;
let mut reader = BufReader::new(file);
let certs: Vec<_> = rustls_pemfile::certs(&mut reader)
let certs: Vec<_> = CertificateDer::pem_reader_iter(&mut reader)
.collect::<std::result::Result<Vec<_>, _>>()
.map_err(|e| Error::tls(format!("failed to parse certificates: {e}")))?;
@@ -456,20 +456,11 @@ fn load_key(path: &Path) -> Result<PrivateKeyDer<'static>> {
let file = File::open(path).map_err(|e| Error::tls(format!("failed to open key file: {e}")))?;
let mut reader = BufReader::new(file);
loop {
let item = rustls_pemfile::read_one(&mut reader)
.map_err(|e| Error::tls(format!("failed to parse key file: {e}")))?;
match item {
Some(rustls_pemfile::Item::Pkcs1Key(key)) => return Ok(key.into()),
Some(rustls_pemfile::Item::Pkcs8Key(key)) => return Ok(key.into()),
Some(rustls_pemfile::Item::Sec1Key(key)) => return Ok(key.into()),
None => break,
_ => {}
}
}
Err(Error::tls("no private key found in file"))
PrivateKeyDer::pem_reader_iter(&mut reader)
.next()
.transpose()
.map_err(|e| Error::tls(format!("failed to parse key file: {e}")))?
.ok_or_else(|| Error::tls("no private key found in file"))
}
/// Build an OCSF context for gateway-level (non-sandbox) events.
crates/openshell-server/tests/common/mod.rs
+2 -3
View File
@@ -32,8 +32,7 @@ use openshell_core::proto::{
use openshell_server::{MultiplexedService, Store, TlsAcceptor, health_router};
use rcgen::{CertificateParams, IsCa};
use rustls::RootCertStore;
use rustls::pki_types::CertificateDer;
use rustls_pemfile::certs;
use rustls::pki_types::{CertificateDer, pem::PemObject};
use std::io::Write;
use std::net::SocketAddr;
use std::sync::Arc;
@@ -871,7 +870,7 @@ pub async fn test_health_store() -> Arc<Store> {
pub fn build_tls_root(cert_pem: &[u8]) -> RootCertStore {
let mut roots = RootCertStore::empty();
let mut cursor = std::io::Cursor::new(cert_pem);
let parsed = certs(&mut cursor)
let parsed = CertificateDer::pem_reader_iter(&mut cursor)
.collect::<Result<Vec<CertificateDer<'static>>, _>>()
.expect("failed to parse cert pem");
for cert in parsed {
crates/openshell-server/tests/edge_tunnel_auth.rs
+5 -4
View File
@@ -37,8 +37,7 @@ use hyper_rustls::HttpsConnectorBuilder;
use hyper_util::{client::legacy::Client, rt::TokioExecutor};
use openshell_core::proto::{HealthRequest, ServiceStatus, open_shell_client::OpenShellClient};
use openshell_server::TlsAcceptor;
use rustls::pki_types::CertificateDer;
use rustls_pemfile::certs;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use tonic::Status;
use tonic::transport::{Channel, ClientTlsConfig, Endpoint};
@@ -112,13 +111,15 @@ fn https_client_mtls(
let roots = build_tls_root(&pki.ca_cert_pem);
let client_certs = {
let mut cursor = std::io::Cursor::new(&pki.client_cert_pem);
certs(&mut cursor)
CertificateDer::pem_reader_iter(&mut cursor)
.collect::<Result<Vec<CertificateDer<'static>>, _>>()
.expect("failed to parse client cert pem")
};
let client_key = {
let mut cursor = std::io::Cursor::new(&pki.client_key_pem);
rustls_pemfile::private_key(&mut cursor)
PrivateKeyDer::pem_reader_iter(&mut cursor)
.next()
.transpose()
.expect("failed to parse client key pem")
.expect("no private key found")
};
crates/openshell-server/tests/multiplex_tls_integration.rs
+5 -4
View File
@@ -14,8 +14,7 @@ use hyper::StatusCode;
use hyper_rustls::HttpsConnectorBuilder;
use hyper_util::{client::legacy::Client, rt::TokioExecutor};
use openshell_core::proto::{HealthRequest, ServiceStatus, open_shell_client::OpenShellClient};
use rustls::pki_types::CertificateDer;
use rustls_pemfile::certs;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use tonic::transport::{ClientTlsConfig, Endpoint};
/// Build an HTTPS client with mTLS (CA trust + client cert/key).
@@ -29,13 +28,15 @@ fn https_client_mtls(
let client_certs = {
let mut cursor = std::io::Cursor::new(&pki.client_cert_pem);
certs(&mut cursor)
CertificateDer::pem_reader_iter(&mut cursor)
.collect::<Result<Vec<CertificateDer<'static>>, _>>()
.expect("failed to parse client cert pem")
};
let client_key = {
let mut cursor = std::io::Cursor::new(&pki.client_key_pem);
rustls_pemfile::private_key(&mut cursor)
PrivateKeyDer::pem_reader_iter(&mut cursor)
.next()
.transpose()
.expect("failed to parse client key pem")
.expect("no private key found")
};
crates/openshell-server/tests/spiffe_jwt.rs
+64
View File
@@ -0,0 +1,64 @@
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
use std::time::{SystemTime, UNIX_EPOCH};
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
use jsonwebtoken::{Algorithm, EncodingKey, Header};
use rcgen::PublicKeyData as _;
use serde_json::json;
use spiffe::{JwtBundle, JwtBundleSet, JwtSvid, TrustDomain};
#[test]
fn spiffe_verifies_signed_jwt_svids_with_the_selected_crypto_backend() {
let key = openshell_crypto::pki::generate_keypair().unwrap();
let public_key = key.der_bytes();
let jwks = json!({
"keys": [{
"kty": "EC",
"kid": "test-key",
"crv": "P-256",
"x": URL_SAFE_NO_PAD.encode(&public_key[1..33]),
"y": URL_SAFE_NO_PAD.encode(&public_key[33..65]),
}],
});
let mut bundles = JwtBundleSet::new();
bundles.add_bundle(
JwtBundle::from_jwt_authorities(
TrustDomain::new("example.org").unwrap(),
&serde_json::to_vec(&jwks).unwrap(),
)
.unwrap(),
);
let mut header = Header::new(Algorithm::ES256);
header.kid = Some("test-key".into());
let now = SystemTime::now()
.duration_since(UNIX_EPOCH)
.unwrap()
.as_secs();
let mut claims = json!({
"sub": "spiffe://example.org/supervisor",
"aud": ["openshell"],
"exp": now + 300,
});
let signing_key = EncodingKey::from_ec_pem(key.serialize_pem().unwrap().as_bytes()).unwrap();
let token = openshell_crypto::jwt::encode(&header, &claims, &signing_key).unwrap();
let svid = JwtSvid::parse_and_validate(&token, &bundles, &["openshell"]).unwrap();
assert_eq!(
svid.spiffe_id().to_string(),
"spiffe://example.org/supervisor"
);
assert!(JwtSvid::parse_and_validate(&token, &bundles, &["another-audience"]).is_err());
let untrusted_key = openshell_crypto::pki::generate_keypair().unwrap();
let untrusted_key =
EncodingKey::from_ec_pem(untrusted_key.serialize_pem().unwrap().as_bytes()).unwrap();
let forged = openshell_crypto::jwt::encode(&header, &claims, &untrusted_key).unwrap();
assert!(JwtSvid::parse_and_validate(&forged, &bundles, &["openshell"]).is_err());
claims["exp"] = json!(now - 300);
let expired = openshell_crypto::jwt::encode(&header, &claims, &signing_key).unwrap();
assert!(JwtSvid::parse_and_validate(&expired, &bundles, &["openshell"]).is_err());
}
crates/openshell-supervisor-network/Cargo.toml
-1
View File
@@ -44,7 +44,6 @@ regorus = { version = "0.9", default-features = false, features = ["std", "arc",
reqwest = { workspace = true }
rustls = { workspace = true }
rustls-native-certs = { workspace = true }
rustls-pemfile = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
serde_yml = { workspace = true }
crates/openshell-supervisor-network/src/l7/tls.rs
+11 -10
View File
@@ -12,7 +12,7 @@ use miette::{IntoDiagnostic, Result, WrapErr, miette};
use openshell_crypto::pki::KeyPair;
use rcgen::{CertificateParams, DnType, IsCa, KeyUsagePurpose};
use rustls::ClientConfig;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName, pem::PemObject};
use std::collections::HashMap;
use std::io::{BufReader, Write as _};
use std::path::{Path, PathBuf};
@@ -105,7 +105,7 @@ impl SandboxCa {
let ca_key = KeyPair::from_pem(private_key_pem)
.into_diagnostic()
.wrap_err("parse proxy CA private key")?;
let certificates = rustls_pemfile::certs(&mut certificate_pem.as_bytes())
let certificates = CertificateDer::pem_reader_iter(&mut certificate_pem.as_bytes())
.collect::<std::result::Result<Vec<_>, _>>()
.into_diagnostic()
.wrap_err("parse proxy CA certificate")?;
@@ -114,7 +114,9 @@ impl SandboxCa {
"proxy CA certificate file must contain exactly one certificate"
));
}
let private_key = rustls_pemfile::private_key(&mut private_key_pem.as_bytes())
let private_key = PrivateKeyDer::pem_reader_iter(&mut private_key_pem.as_bytes())
.next()
.transpose()
.into_diagnostic()
.wrap_err("parse proxy CA private key")?
.ok_or_else(|| miette!("proxy CA private key file contains no private key"))?;
@@ -428,10 +430,9 @@ fn load_pem_certs_into_store(
return (0, 0);
}
let mut reader = BufReader::new(pem_data.as_bytes());
// Collect all results so we can count PEM blocks that fail base64
// decoding — rustls_pemfile::certs silently drops those, so without
// this they wouldn't be reflected in the `ignored` count.
let all_results: Vec<_> = rustls_pemfile::certs(&mut reader).collect();
// Count PEM decoding errors before filtering them out so they contribute
// to the `ignored` count alongside certificates rejected by the root store.
let all_results: Vec<_> = CertificateDer::pem_reader_iter(&mut reader).collect();
let pem_errors = all_results.iter().filter(|r| r.is_err()).count();
let certs: Vec<CertificateDer<'static>> =
all_results.into_iter().filter_map(Result::ok).collect();
@@ -460,7 +461,7 @@ pub fn read_system_ca_bundle() -> String {
pub fn parse_pem_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
let file = std::fs::File::open(path).into_diagnostic()?;
let mut reader = BufReader::new(file);
rustls_pemfile::certs(&mut reader)
CertificateDer::pem_reader_iter(&mut reader)
.collect::<std::result::Result<Vec<_>, _>>()
.into_diagnostic()
}
@@ -736,7 +737,7 @@ mod tests {
// Bundle should be parseable as PEM certificates
let mut reader = BufReader::new(bundle_pem.as_bytes());
assert!(
rustls_pemfile::certs(&mut reader).any(|r| r.is_ok()),
CertificateDer::pem_reader_iter(&mut reader).any(|r| r.is_ok()),
"bundle should contain at least one cert",
);
}
@@ -772,7 +773,7 @@ mod tests {
assert_eq!(loaded.cert_pem(), certificate);
assert_eq!(loaded.private_key_pem().unwrap(), private_key);
let original_der = rustls_pemfile::certs(&mut certificate.as_bytes())
let original_der = CertificateDer::pem_reader_iter(&mut certificate.as_bytes())
.next()
.unwrap()
.unwrap();
crates/openshell-supervisor-network/src/proxy/relay.rs
+2 -1
View File
@@ -471,9 +471,10 @@ mod tests {
#[tokio::test]
async fn tls_http_relay_reuses_then_sends_close_notify_after_complete_response() {
use crate::l7::tls::{CertCache, ProxyTlsState, SandboxCa, tls_terminate_client};
use rustls::pki_types::{CertificateDer, pem::PemObject};
let ca = SandboxCa::generate().unwrap();
let mut roots = rustls::RootCertStore::empty();
for cert in rustls_pemfile::certs(&mut ca.cert_pem().as_bytes()) {
for cert in CertificateDer::pem_reader_iter(&mut ca.cert_pem().as_bytes()) {
roots.add(cert.unwrap()).unwrap();
}
let config = Arc::new(
deny.toml
+1 -14
View File
@@ -14,20 +14,7 @@ yanked = "warn"
unmaintained = "workspace"
maximum-db-staleness = "P30D"
ignore = [
# Pre-existing advisories acknowledged at onboarding. Each should be
# resolved by upgrading the affected transitive dependency and then
# removing the ignore entry.
{ id = "RUSTSEC-2026-0190", reason = "anyhow unsoundness in downcast_mut — awaiting upstream fix" },
{ id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" },
{ id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" },
{ id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" },
# SPIFFE's jsonwebtoken RustCrypto stack still requires crypto-bigint 0.5.
# Remove after compatible upstream releases include the dependency upgrade:
# https://github.com/Keats/jsonwebtoken/pull/536
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 timing variability — transitive via SPIFFE/jsonwebtoken; remove when the dependency chain supports crypto-bigint >=0.7.6" },
{ id = "RUSTSEC-2026-0391", reason = "zstd context reuse leaks prior stream data — VM driver and zip create fresh contexts; remove when the dependency chain supports zstd >=0.14.3" },
{ id = "RUSTSEC-2026-0398", reason = "zstd-safe seekable decompression memory corruption — current consumers do not use the seekable API; remove when the dependency chain supports zstd-safe >=8.2.0" },
{ id = "RUSTSEC-2026-0403", reason = "zstd-safe legacy frame error leaks uninitialized memory through write decoders — VM driver and zip use read decoders; remove when the dependency chain supports zstd-safe >=8.2.0" },
{ id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — required by russh/ssh-key and RSA test fixtures; no patched release is available" },
]
# -- Licenses ------------------------------------------------------------------
e2e/rust/Cargo.lock
Generated
-10
View File
@@ -2039,7 +2039,6 @@ dependencies = [
"prost",
"rand 0.9.5",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"serial_test",
@@ -2638,15 +2637,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
e2e/rust/Cargo.toml
-1
View File
@@ -290,7 +290,6 @@ sha2 = "0.10"
hex = "0.4"
rand = "0.9"
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12"] }
rustls-pemfile = "2"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yml = { package = "noyalib", version = "0.0.53", default-features = false, features = ["std", "compat-serde-yaml"] }
e2e/rust/tests/service_bearer_passthrough.rs
+6 -4
View File
@@ -22,7 +22,7 @@ use hyper_util::rt::TokioIo;
use openshell_e2e::harness::binary::openshell_cmd;
use openshell_e2e::harness::sandbox::{E2E_WORKLOAD_IMAGE, SandboxGuard};
use rustls::RootCertStore;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName, pem::PemObject};
use serde_json::Value;
use tokio::io::{AsyncRead, AsyncWrite};
use tokio::net::TcpStream;
@@ -32,7 +32,7 @@ use url::Position;
const SERVICE_PORT: &str = "4500";
const BEARER_TOKEN: &str = "Bearer openshell-e2e-application-token";
const READY_TIMEOUT: Duration = Duration::from_secs(60);
const READY_TIMEOUT: Duration = Duration::from_mins(1);
const HEADER_ECHO_SERVER: &str = r#"
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -129,7 +129,7 @@ fn load_certificates(
let file = File::open(path)
.map_err(|error| format!("open {description} '{}': {error}", path.display()))?;
let mut reader = BufReader::new(file);
rustls_pemfile::certs(&mut reader)
CertificateDer::pem_reader_iter(&mut reader)
.collect::<Result<Vec<_>, _>>()
.map_err(|error| format!("parse {description} '{}': {error}", path.display()))
}
@@ -138,7 +138,9 @@ fn load_private_key(path: &Path) -> Result<PrivateKeyDer<'static>, String> {
let file = File::open(path)
.map_err(|error| format!("open client TLS key '{}': {error}", path.display()))?;
let mut reader = BufReader::new(file);
rustls_pemfile::private_key(&mut reader)
PrivateKeyDer::pem_reader_iter(&mut reader)
.next()
.transpose()
.map_err(|error| format!("parse client TLS key '{}': {error}", path.display()))?
.ok_or_else(|| format!("client TLS key '{}' is empty", path.display()))
}
examples/governance-interceptor/Cargo.lock
Generated
+2 -12
View File
@@ -1871,7 +1871,6 @@ dependencies = [
"protoc-bin-vendored",
"rustix",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2308,9 +2307,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
[[package]]
name = "pulldown-cmark"
version = "0.13.4"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags",
"memchr",
@@ -2509,15 +2508,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
examples/isolation-backend-v8/Cargo.lock
Generated
+2 -14
View File
@@ -1656,7 +1656,6 @@ dependencies = [
"protoc-bin-vendored",
"rustix 1.1.5",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2140,7 +2139,6 @@ dependencies = [
"protoc-bin-vendored",
"rustix 1.1.5",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2225,7 +2223,6 @@ dependencies = [
"rcgen",
"rustix 1.1.5",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"socket2",
@@ -2574,9 +2571,9 @@ dependencies = [
[[package]]
name = "pulldown-cmark"
version = "0.13.4"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags",
"memchr",
@@ -2789,15 +2786,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
examples/isolation-backend-v8/Cargo.toml
-1
View File
@@ -20,7 +20,6 @@ openshell-sandbox-backend = { path = "../../crates/openshell-sandbox-backend" }
rustix = { version = "1", features = ["process"] }
tokio-rustls = "0.26"
rustls = "0.23"
rustls-pemfile = "2"
clap = { version = "4.5", features = ["derive", "env"] }
prost = "0.14"
prost-types = "0.14"
examples/isolation-backend-v8/src/lifecycle.rs
+5 -2
View File
@@ -11,6 +11,7 @@ use anyhow::{Result, ensure};
use openshell_core::jwt::{SandboxId, SessionJwtVerifier, SessionTokenProfile, SystemJwtClock};
use openshell_isolation_interface::contract::BoundaryConfirmation;
use openshell_sandbox_backend::{boundary_protocol as wire, sandbox_auth::*};
use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use sha2::{Digest, Sha256};
use std::{
collections::{HashMap, HashSet},
@@ -655,9 +656,11 @@ pub async fn serve(state_dir: PathBuf) -> Result<()> {
tokio::time::sleep(Duration::from_millis(100)).await;
}
let launch: Launch = serde_json::from_slice(&std::fs::read(&path)?)?;
let certs = rustls_pemfile::certs(&mut launch.certificate.as_bytes())
let certs = CertificateDer::pem_reader_iter(&mut launch.certificate.as_bytes())
.collect::<std::result::Result<Vec<_>, _>>()?;
let key = rustls_pemfile::private_key(&mut launch.private_key.as_bytes())?
let key = PrivateKeyDer::pem_reader_iter(&mut launch.private_key.as_bytes())
.next()
.transpose()?
.ok_or_else(|| anyhow::anyhow!("missing TLS key"))?;
let mut tls =
rustls::ServerConfig::builder_with_protocol_versions(&[&rustls::version::TLS13])
examples/supervisor-middleware-content-guard/Cargo.lock
Generated
+2 -12
View File
@@ -2025,7 +2025,6 @@ dependencies = [
"protoc-bin-vendored",
"rustix",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2430,9 +2429,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
[[package]]
name = "pulldown-cmark"
version = "0.13.4"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags",
"memchr",
@@ -2631,15 +2630,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
tests/suites/conformance/Cargo.lock
Generated
+4 -14
View File
@@ -56,9 +56,9 @@ dependencies = [
[[package]]
name = "anyhow"
version = "1.0.102"
version = "1.0.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
[[package]]
name = "asn1-rs"
@@ -1911,7 +1911,6 @@ dependencies = [
"reqwest",
"rustix",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2349,9 +2348,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
[[package]]
name = "pulldown-cmark"
version = "0.13.3"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags",
"memchr",
@@ -2630,15 +2629,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.14.0"
tests/suites/features/Cargo.lock
Generated
-10
View File
@@ -1865,7 +1865,6 @@ dependencies = [
"prost",
"rand 0.9.5",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha1 0.10.7",
@@ -2432,15 +2431,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
tests/testkit/Cargo.lock
Generated
+4 -14
View File
@@ -56,9 +56,9 @@ dependencies = [
[[package]]
name = "anyhow"
version = "1.0.102"
version = "1.0.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
[[package]]
name = "asn1-rs"
@@ -1900,7 +1900,6 @@ dependencies = [
"reqwest",
"rustix",
"rustls",
"rustls-pemfile",
"serde",
"serde_json",
"sha2 0.10.9",
@@ -2330,9 +2329,9 @@ checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
[[package]]
name = "pulldown-cmark"
version = "0.13.3"
version = "0.13.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad"
checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
dependencies = [
"bitflags",
"memchr",
@@ -2611,15 +2610,6 @@ dependencies = [
"security-framework",
]
[[package]]
name = "rustls-pemfile"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "rustls-pki-types"
version = "1.14.0"