Repository navigation
0.103.16: reject cert paths containing distrusted SPKIs - #546
Merged
Merged
Conversation
Match SPKI bytes throughout the path, including leaves and trust anchors against a static list of distrusted keys. Keys that match are rejected as distrusted for path building purposes.
Resolve NOSTD_TARGET through the GitHub Actions env context when passing it to rust-toolchain. The action previously inserted the input into shell source, which expanded the variable. Its updated argument handling preserves the literal value, causing toolchain installation to fail in both no-std jobs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## rel-0.103 #546 +/- ##
=============================================
+ Coverage 97.42% 97.48% +0.06%
=============================================
Files 19 19
Lines 3843 3943 +100
=============================================
+ Hits 3744 3844 +100
Misses 99 99 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
djc
approved these changes
Oct 20, 2026
ctz
approved these changes
Oct 20, 2026
This was referenced Oct 20, 2026
Merged
1 of 4 tasks
1 of 4 tasks
4 tasks done
5 of 7 tasks
This was referenced Oct 20, 2026
Closed
This was referenced Oct 20, 2026
Open
lbailey94
added a commit
to lbailey94/whitemagic
that referenced
this pull request
Oct 22, 2026
Second half of RUSTSEC-2026-0382 (same emSign distrust issue, announced via rustls/webpki#546): the verifier itself accepted certificate paths through distrusted emSign intermediates. Patched in >= 0.103.16. The preceding commit moved the bundled anchors; this one moves the code that checks them. Both were red on main and are the reason the cargo-deny gate existed without anyone acting on it.
This was referenced Oct 22, 2026
2 of 4 tasks
bsod90
added a commit
to cube-js/cube
that referenced
this pull request
Oct 22, 2026
#12378) eMudhra (emSign) intermediate CA keys were compromised; the rustls stack now refuses them. `webpki-roots` 1.0.10 drops the emSign roots ([rustls/webpki-roots@c644e3e](rustls/webpki-roots@c644e3e)) and `rustls-webpki` 0.103.16 rejects any chain containing the distrusted intermediate keys ([rustls/webpki#546](rustls/webpki#546)). The Node side was fixed by the Node 24.22.1 bump in v1.8.10; the Rust lockfiles were not touched there. Lockfile-only. `webpki-roots` 0.26.11 is the compatibility shim that re-exports 1.x, so moving the 0.26 copies to it pulls 1.0.10 without bumping `reqwest`/`hyper-rustls`. | Lockfile | `webpki-roots` | `rustls-webpki` | |---|---|---| | `rust/cubestore` | 0.26.1 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `rust/cubesql` | 0.26.3 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `packages/cubejs-backend-native` | 0.26.3 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `rust/cube` | 1.0.7 → 1.0.10 | 0.103.13 → 0.103.16 | | `rust/cube-cli` | — | 0.103.13 → 0.103.16 | No other packages move. `webpki-root-certs` is not in any tree. Cube Store's S3/GCS remote FS uses native-tls (the image's system CA store), so it is unaffected by this change. `cargo check --locked` passes in `rust/cubesql` (`--all-targets`), `rust/cube`, `rust/cube-cli` and `packages/cubejs-backend-native`. In `rust/cubestore` the TLS crates compile locally, but the full check stops at a macOS-only `librdkafka` link error, so CI is the check there. **Check List** - [x] Tests have been run in packages where changes have been made if available - [x] Linter has been run for changed code - [ ] Tests for the changes have been added if not covered yet - [ ] Docs have been added / updated if required 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
marcosgabrielgomes110-collab
added a commit
to marcosgabrielgomes110-collab/rmp
that referenced
this pull request
Oct 22, 2026
Fixes the RUSTSEC advisory about distrusted emSign intermediate public keys (rustls/webpki#546). cargo-deny was failing on main. Co-authored-by: CodeMarcos <marcosgabrielgomes110-collab@users.noreply.github.com>
5 of 16 tasks
molexxxx
added a commit
to molexxxx/zero-server
that referenced
this pull request
Oct 22, 2026
RUSTSEC-2026-0382 reports that certificate verification in rustls-webpki 0.103.15 may accept a path through a small set of distrusted intermediate certificates, and cargo deny refuses the locked version. 0.103.16, released 2026-10-20 (https://crates.io/api/v1/crates/rustls-webpki, read 2026-10-22, not yanked), rejects certificate paths that contain those subject public keys. The lockfile moves to it and the vet exemption moves with it; cargo deny on both graphs, cargo vet, the TLS and serve tests and workspace clippy pass. Release notes: https://github.com/rustls/webpki/releases/tag/v%2F0.103.16 Advisory announcement: rustls/webpki#546
This was referenced Oct 23, 2026
kelly-musk
pushed a commit
to kelly-musk/fedimint
that referenced
this pull request
Oct 24, 2026
…9393) ## Summary Apply the compatible **modern TLS** portion of fedimint#9381: resolve `rustls-webpki 0.103.16`, `webpki-roots 1.0.10`, and `webpki-root-certs 1.0.10`, and preserve the active modern verifier/root minimums for downstream consumers. This is not completion of the legacy TLS work or a claim that Cargo audit is green. ## Details - Set the existing workspace `webpki-roots` requirement to `1.0.10`. - Add a native-only `rustls-webpki = "0.103.16"` security-floor dependency to shared `fedimint-core`, with default features disabled. Current Rustls `0.23.46` still permits WebPKI `^0.103.14`; simply raising existing TLS parent minimums cannot guarantee the fixed verifier in a published library's downstream resolution. The comment and narrow cargo-udeps exemption document this intentional transitive dependency constraint. No crypto-provider or custom-verifier behavior changes. - Update only the three compatible low-level package versions in `Cargo.lock`; leave LDK, Esplora, reqwest, Iroh, and legacy WebPKI lines unchanged. - `webpki-root-certs` is lock-only: the resolved platform verifier selects this bundled list for its `wasm32` fallback, absent from our native Linux and browser connector graphs. Do not add an artificial runtime root-list dependency or claim a published minimum for that inactive fallback. Upstream changes: [WebPKI SPKI distrust fix](rustls/webpki#546), [root removal](rustls/webpki-roots#133). Published old/new source checksums and dependency ranges were independently reviewed. The modern Iroh/platform-verifier and Electrum paths resolve the fixed modern verifier; browser TLS remains browser-managed. ## Testing Using the pinned Nix development environments: - `just format`, `just final-lint` (workspace/all-targets Clippy with warnings denied, lint, manifest sort). - All-target checks for `fedimint-core`, `fedimint-connectors`, and `fedimint-bitcoind`; all 9 connector unit tests passed. - `crossWasm` checks for core/connectors passed, with warnings from unchanged WASM source. - Standalone downstream resolver probes using actual Cargo-normalized core/connector packages (local patches only for unpublished Fedimint sibling packages): patched versions resolve; explicit old `0.103.15`/`1.0.9` selections conflict with the published manifest minimums rather than silently coexisting. - Unmodified upstream synthetic `verify_cert::tests::distrusted_spki` passed: valid-chain and alternate-cross-sign controls, direct distrust, and shared-SPKI cross-sign rejection. All 30 published production source files match the tested upstream release exactly. Public source-data checks also confirm the removed root is absent from both 120-entry root sets and the eight production distrust keys match published checksums. No live MITM test or private compromised keys. - Same current RustSec database: baseline audit reports 6 vulnerability entries, this change reports 3. Audit still fails for legacy `rustls-webpki 0.101.7`, `0.102.8`, and `webpki-roots 0.25.4`; no advisory suppression was added. - Independent multipart dependency/security review passed for the final commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#545 but applied to rel-0.103 to prep 0.103.16.
Proposed release notes:
Distrust a small set of intermediate certificate subject public keys due to specific security concerns around their operation.