From fc752319ca7d4d4af73507aaea19a9e074ed61ea Mon Sep 17 00:00:00 2001 From: Vladimir Rotariu Date: Wed, 21 Oct 2026 13:44:26 -0600 Subject: [PATCH 1/2] fix(deps): bump rustls-webpki and webpki roots for RUSTSEC-2026-0381..0383 cargo audit fails on main again since the three advisories were published on 2026-10-20, so every open pull request reads red on security-audit. All three crates reach the brain through reqwest (provider calls). The fixes reject distrusted intermediate keys and drop the emSign roots; no API change. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UpyrhbDTW1gBwzGAC44GYU --- CHANGELOG.md | 8 ++++++++ Cargo.lock | 20 ++++++++++---------- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a9012908..5c9a4e15 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,14 @@ Releases before `0.2.5` predate the public launch; their notes live in the ### Security +- **The provider TLS path stops trusting distrusted emSign certificates.** + ([#PRNUM](https://github.com/lacs-project/sysknife/pull/PRNUM)) + RUSTSEC-2026-0381 to 0383: webpki-roots and webpki-root-certs 1.0.7 still + bundled the emSign roots, and rustls-webpki 0.103.15 accepted chains through + a small set of distrusted intermediates. All three reach the brain through + reqwest, which carries every provider call. The lockfile moves to + rustls-webpki 0.103.16 and the 1.0.10 root lists; no API changes. + - **rustls moves to 0.23.46.** ([#616](https://github.com/lacs-project/sysknife/pull/616)) RUSTSEC-2026-0346 to 0349 reached the brain through reqwest, which carries provider calls, and the daemon through sqlx's Postgres TLS. The worst of the diff --git a/Cargo.lock b/Cargo.lock index 4e6dd3c8..50ed7de0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2098,7 +2098,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -3793,7 +3793,7 @@ dependencies = [ "wasm-bindgen", "wasm-bindgen-futures", "web-sys", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -4059,9 +4059,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -4611,7 +4611,7 @@ dependencies = [ "tracing", "url", "uuid", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -6136,9 +6136,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -6149,14 +6149,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] From b49210e777ef5903e1a79375e3fae95c70d16828 Mon Sep 17 00:00:00 2001 From: Vladimir Rotariu Date: Wed, 21 Oct 2026 13:57:39 -0600 Subject: [PATCH 2/2] docs(changelog): link #628 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UpyrhbDTW1gBwzGAC44GYU --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5c9a4e15..b8480fe8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,7 @@ Releases before `0.2.5` predate the public launch; their notes live in the ### Security - **The provider TLS path stops trusting distrusted emSign certificates.** - ([#PRNUM](https://github.com/lacs-project/sysknife/pull/PRNUM)) + ([#628](https://github.com/lacs-project/sysknife/pull/628)) RUSTSEC-2026-0381 to 0383: webpki-roots and webpki-root-certs 1.0.7 still bundled the emSign roots, and rustls-webpki 0.103.15 accepted chains through a small set of distrusted intermediates. All three reach the brain through