diff --git a/CHANGELOG.md b/CHANGELOG.md index 4c8a718f..d2175566 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,28 @@ While Underlay is `0.x`, breaking changes raise the minor version. ## [Unreleased] +### Security +- `underlay-auth-jwt` builds `jsonwebtoken` with the `aws_lc_rs` backend + instead of `rust_crypto`. Underlay signs and verifies Ed25519 only, and the + RustCrypto backend pulled in `rsa` (RUSTSEC-2023-0071, no fixed release) + plus unused curve crates. `aws-lc-rs` was already in consumer graphs through + rustls. Underlay's `deny.toml` drops its `RUSTSEC-2023-0071` ignore and + allow-lists the `nightfire` git source, so `cargo deny check` passes. +- Impact class: dependency change only; no public Rust or TypeScript API + change and no token-format change (Ed25519 signatures are deterministic, so + existing tokens keep verifying). +- Affected consumers: all Rust consumers of `underlay-auth-jwt`. +- Required actions: +- Pin the new tag on every Underlay declaration and regenerate `Cargo.lock` + and `bun.lock`; `rsa` leaves the lockfile. +- Remove any `RUSTSEC-2023-0071` ignore from the consumer's `deny.toml`. +- Validation: `cargo deny check advisories` in the consumer; its JWT login and + refresh tests. +- Deprecation/removal date: n/a. +- Rollback: return all Underlay pins to the previous tag. +- Reference docs: + [contract 023](docs/knowledge/contracts/023-release-and-compatibility-rollout.md). + ## [0.10.4] - 2026-10-15 ### Changed diff --git a/Cargo.lock b/Cargo.lock index cda31da1..275d4238 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -269,6 +269,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", + "untrusted 0.7.1", "zeroize", ] @@ -1377,22 +1378,6 @@ dependencies = [ "cmov", ] -[[package]] -name = "curve25519-dalek" -version = "4.1.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" -dependencies = [ - "cfg-if", - "cpufeatures 0.2.17", - "curve25519-dalek-derive", - "digest 0.10.7", - "fiat-crypto 0.2.9", - "rustc_version", - "subtle", - "zeroize", -] - [[package]] name = "curve25519-dalek" version = "5.0.0" @@ -1403,7 +1388,7 @@ dependencies = [ "cpufeatures 0.3.1", "curve25519-dalek-derive", "digest 0.11.3", - "fiat-crypto 0.3.0", + "fiat-crypto", "rand_core 0.10.1", "rustc_version", "subtle", @@ -1706,16 +1691,6 @@ dependencies = [ "spki 0.7.3", ] -[[package]] -name = "ed25519" -version = "2.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" -dependencies = [ - "pkcs8 0.10.2", - "signature 2.2.0", -] - [[package]] name = "ed25519" version = "3.0.0" @@ -1726,28 +1701,14 @@ dependencies = [ "signature 3.0.0", ] -[[package]] -name = "ed25519-dalek" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" -dependencies = [ - "curve25519-dalek 4.1.3", - "ed25519 2.2.3", - "serde", - "sha2 0.10.9", - "subtle", - "zeroize", -] - [[package]] name = "ed25519-dalek" version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de" dependencies = [ - "curve25519-dalek 5.0.0", - "ed25519 3.0.0", + "curve25519-dalek", + "ed25519", "rand_core 0.10.1", "serde", "sha2 0.11.0", @@ -1777,7 +1738,6 @@ dependencies = [ "ff", "generic-array", "group", - "hkdf 0.12.4", "pem-rfc7468", "pkcs8 0.10.2", "rand_core 0.6.4", @@ -1899,12 +1859,6 @@ dependencies = [ "subtle", ] -[[package]] -name = "fiat-crypto" -version = "0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" - [[package]] name = "fiat-crypto" version = "0.3.0" @@ -2256,15 +2210,6 @@ version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" -[[package]] -name = "hkdf" -version = "0.12.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" -dependencies = [ - "hmac 0.12.1", -] - [[package]] name = "hkdf" version = "0.13.0" @@ -2829,18 +2774,12 @@ version = "11.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1" dependencies = [ + "aws-lc-rs", "base64 0.22.1", - "ed25519-dalek 2.2.0", "getrandom 0.2.17", - "hmac 0.12.1", "js-sys", - "p256", - "p384", - "rand 0.8.8", - "rsa", "serde", "serde_json", - "sha2 0.10.9", "signature 2.2.0", "zeroize", ] @@ -2850,9 +2789,6 @@ name = "lazy_static" version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" -dependencies = [ - "spin 0.9.9", -] [[package]] name = "lettre" @@ -2887,12 +2823,6 @@ version = "0.2.189" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" -[[package]] -name = "libm" -version = "0.2.16" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981" - [[package]] name = "libsqlite3-sys" version = "0.37.0" @@ -3122,22 +3052,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "num-bigint-dig" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7" -dependencies = [ - "lazy_static", - "libm", - "num-integer", - "num-iter", - "num-traits", - "rand 0.8.8", - "smallvec", - "zeroize", -] - [[package]] name = "num-complex" version = "0.4.6" @@ -3190,7 +3104,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" dependencies = [ "autocfg", - "libm", ] [[package]] @@ -3289,18 +3202,6 @@ dependencies = [ "sha2 0.10.9", ] -[[package]] -name = "p384" -version = "0.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" -dependencies = [ - "ecdsa", - "elliptic-curve", - "primeorder", - "sha2 0.10.9", -] - [[package]] name = "parking" version = "2.2.1" @@ -3461,17 +3362,6 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" -[[package]] -name = "pkcs1" -version = "0.7.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" -dependencies = [ - "der 0.7.10", - "pkcs8 0.10.2", - "spki 0.7.3", -] - [[package]] name = "pkcs8" version = "0.10.2" @@ -4035,7 +3925,7 @@ dependencies = [ "cfg-if", "getrandom 0.2.17", "libc", - "untrusted", + "untrusted 0.9.0", "windows-sys 0.52.0", ] @@ -4048,26 +3938,6 @@ dependencies = [ "xmlparser", ] -[[package]] -name = "rsa" -version = "0.9.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d" -dependencies = [ - "const-oid 0.9.6", - "digest 0.10.7", - "num-bigint-dig", - "num-integer", - "num-traits", - "pkcs1", - "pkcs8 0.10.2", - "rand_core 0.6.4", - "signature 2.2.0", - "spki 0.7.3", - "subtle", - "zeroize", -] - [[package]] name = "rustc-hash" version = "2.1.3" @@ -4192,7 +4062,7 @@ dependencies = [ "aws-lc-rs", "ring", "rustls-pki-types", - "untrusted", + "untrusted 0.9.0", ] [[package]] @@ -4746,7 +4616,7 @@ dependencies = [ "futures-core", "futures-util", "hex", - "hkdf 0.13.0", + "hkdf", "hmac 0.13.0", "itoa", "log", @@ -5434,7 +5304,7 @@ dependencies = [ "async-trait", "base64 0.22.1", "chrono", - "ed25519-dalek 3.0.0", + "ed25519-dalek", "jsonwebtoken", "rand 0.10.3", "serde", @@ -5954,6 +5824,12 @@ dependencies = [ "ctutils", ] +[[package]] +name = "untrusted" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a" + [[package]] name = "untrusted" version = "0.9.0" diff --git a/deny.toml b/deny.toml index bb8a51a2..c9f1ef1d 100644 --- a/deny.toml +++ b/deny.toml @@ -3,12 +3,9 @@ all-features = false features = ["underlay-blob/s3", "underlay-email/ses"] [advisories] -ignore = [ - # jsonwebtoken (11.1.0 as of the 2026-09 dependency refresh) still pulls - # rsa 0.9.10 and upstream has no safe upgrade. Keep this explicit so JWT - # RSA usage is reviewed when upstream publishes a patched path. - "RUSTSEC-2023-0071", -] +# jsonwebtoken uses the aws_lc_rs backend, so rsa (RUSTSEC-2023-0071) is no +# longer in the graph and needs no ignore. +ignore = [] [licenses] allow = [ @@ -49,4 +46,4 @@ skip-tree = [] unknown-registry = "deny" unknown-git = "deny" allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] +allow-git = ["https://github.com/inflatable-cookie/nightfire.git"] diff --git a/rust/crates/underlay-auth-jwt/Cargo.toml b/rust/crates/underlay-auth-jwt/Cargo.toml index 4da79a75..f3211584 100644 --- a/rust/crates/underlay-auth-jwt/Cargo.toml +++ b/rust/crates/underlay-auth-jwt/Cargo.toml @@ -9,7 +9,7 @@ async-trait = { workspace = true } base64 = { workspace = true } chrono = { workspace = true } ed25519-dalek = { version = "3", features = ["pkcs8", "rand_core", "alloc"] } -jsonwebtoken = { version = "11", default-features = false, features = ["rust_crypto"] } +jsonwebtoken = { version = "11", default-features = false, features = ["aws_lc_rs"] } rand = { workspace = true } serde = { workspace = true } serde_json = { workspace = true }