Repository navigation
update Rust TLS certificate security patches - #1527
Conversation
The Rust advisory check rejects the certificate verifier and trust roots that SQLx resolves because they allow paths through distrusted emSign intermediates with known private keys. Update `rustls-webpki` from 0.103.15 to 0.103.16 and `webpki-roots` from 1.0.9 to 1.0.10. These patches reject the compromised intermediates and remove the affected root while preserving existing dependency ranges.
bgentry
left a comment
bgentry
left a comment
There was a problem hiding this comment.
🤖 Codex review: No blocking supply-chain findings. Local compatibility verification passes. This account authored the PR, so this is a comment review rather than a GitHub approval. CI is still running; this review does not claim that the pending matrix jobs have passed.
Upgrade
| Package | From | To |
|---|---|---|
| rustls-webpki | 0.103.15 |
0.103.16 |
| webpki-roots | 1.0.9 |
1.0.10 |
Reviewed head: ec074ff63498c2e7311b41fd0aeca2faedaac881, based on d60d16a34b5d8b01032d981564e9f507d96e93d2. Only the two versions and corresponding checksums in rust/Cargo.lock change. The resolved graph retains 212 packages, with identical dependency arrays and canonical registry sources.
Security review
An independent published-artifact review and my upstream/advisory checks found no blocking issues. All four old/new crate archive SHA256 values match the official crates.io sparse index, version metadata, and River's lockfile. The new archive identities are:
rustls-webpki 0.103.16:4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281webpki-roots 1.0.10:1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9
Complete artifact diffs, manifests, packaged lockfiles, VCS metadata, source, tests, and embedded binary data were inspected before executing the updates. Published source matches the official merge commits for rustls/webpki#546 (8ecdcc76f56b68fda67a6adf7976f5eed5006a4c) and rustls/webpki-roots#133 (70760478b9d3ea729b22faa0b5324da38a297c1c), apart from separately reviewed Cargo-generated packaging metadata.
The verifier rejects eight compromised public keys during certificate path building, including cross-signed paths. The embedded keys match the complete compromised SPKI set in the incident inventory. The root package removes only emSign ECC Root CA - G3, reducing its trust store from 121 anchors to 120. These changes match RUSTSEC-2026-0382 and RUSTSEC-2026-0381. Both selected versions are unyanked and within the existing consumers' version constraints.
No new dependencies, features, build hooks, executable binaries, native/unsafe code, network access, credential reads, filesystem writes, or subprocesses are introduced. Publishers are established Rustls maintainers; canonical repositories and licenses are unchanged. webpki-roots raises its MSRV from 1.70 to 1.71, below River's 1.95 minimum. Its packaged development lockfile churn does not enter River's dependency graph.
Compatibility verification
Completed on macOS with Rust 1.98.1, cargo-deny 0.20.2, and disposable Postgres 18.6:
make check/rust/dependencies— passed all advisory, license, ban, and source checks. This is the check failing on master.cargo check --manifest-path rust/Cargo.toml --workspace --all-targets --all-features --locked— passed.make lint/rust— passed, including Postgres-only and SQLite-only feature sets and Postgres integration-test code.make test/rust— passed: 539 tests, including Postgres and SQLite, with one intentionally ignored README doctest.make doc/rust— passed documentation, doctests for all backend feature sets, and example compilation.make check/rust/package— passed workspace archive verification and package-content checks.make check/rust/semver— passed againstrust/v0.3.0using locally installed cargo-semver-checks 0.49.0; CI uses 0.51.0.- Rust CLI TLS smoke checks against disposable Postgres — accepted a trusted localhost certificate with
sslmode=verify-full, rejected the wrong hostname, and rejected an unknown issuer. - The committed lockfile remains unchanged after validation.
The full suite uses CI's normal sslmode=disable connection setting. An initial attempt to enable verified TLS for the entire suite failed at a fault-injection proxy that changes the connection hostname to an IP address; the TLS smoke checks above exercise certificate validation separately. Go-only targets were not run because this change affects only the Rust lockfile. The supported Rust and Postgres matrix and nightly docs.rs build remain covered by the pending CI run.
Residual risk
TLS endpoints relying on the removed root or compromised intermediates will now fail verification as intended. Normal trust in crates.io and upstream maintainer accounts remains; the registry exposes no trusted-publishing attestation for these versions. No additional blocking supply-chain or compatibility issue was identified. Intentionally left unmerged.
|
@brandur moving forward on this for security fix expediency |
The Rust quality job fails its dependency advisory check because SQLx's TLS dependencies include vulnerable certificate verification and trust-root versions. The affected versions can accept paths through distrusted emSign intermediates whose private keys are known.
Update
rustls-webpkifrom 0.103.15 to 0.103.16 andwebpki-rootsfrom 1.0.9 to 1.0.10 to address RUSTSEC-2026-0382 and RUSTSEC-2026-0381. Both patches fit the existing dependency ranges, so the change updates only the committed lockfile.