security: the three red-steel fixes that apply cleanly to current main

.github/workflows/audit.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check advisory ignore metadata
         run: bash scripts/check-deny-advisory-ignores.sh
 
-      - name: Check cargo-deny policy
+      - name: Check advisories, yanked dependencies, and cargo-deny policy
         run: cargo deny check
 
   cargo-audit:

crates/corecrux-receipts/Cargo.toml

@@ -34,7 +34,7 @@ sha2 = { workspace = true }
 tar = { workspace = true }
 thiserror = { workspace = true }
 zstd = { workspace = true }
-zip = { workspace = true, features = ["default"] }
+zip = { workspace = true }
 
 # C2PA X.509 trust-anchor signer (agent-ux-07 M6).
 # `p256` provides the local P-256 leaf key (ECDSA-with-SHA256).

crates/corecruxctl/Cargo.toml

@@ -37,7 +37,7 @@ url = { workspace = true }
 urlencoding = { workspace = true }
 uuid = { workspace = true, features = ["v4"] }
 xxhash-rust = { workspace = true, features = ["xxh64"] }
-zip = { workspace = true, default-features = false, features = ["deflate-flate2"] }
+zip = { workspace = true, default-features = false, features = ["deflate-flate2-zlib-rs"] }
 rand = { workspace = true }
 sha2 = { workspace = true }
 

crates/corecruxctl/src/audit_pack.rs

@@ -2373,6 +2373,7 @@ fn build_integrity_scan_report(opts: &AuditPackOptionsV1) -> IntegrityScanReport
 #[allow(clippy::unwrap_used, clippy::expect_used)]
 mod tests {
     use super::*;
+    use std::io::Write as _;
     use tempfile::tempdir;
 
     fn h(seq: u64, event_id: &str) -> StreamHeaderLineV1 {
@@ -2386,6 +2387,25 @@ mod tests {
         }
     }
 
+    #[test]
+    fn deflated_receipt_export_entry_round_trips() {
+        let expected = b"{\"schema\":\"corecrux.receipt_export.v1\"}\n";
+        let mut cursor = Cursor::new(Vec::new());
+        {
+            let mut writer = zip::ZipWriter::new(&mut cursor);
+            let options = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+            writer
+                .start_file("manifest.json", options)
+                .expect("start deflated manifest entry");
+            writer.write_all(expected).expect("write deflated manifest");
+            writer.finish().expect("finish deflated receipt export");
+        }
+
+        let mut archive = zip::ZipArchive::new(Cursor::new(cursor.into_inner())).expect("open deflated receipt export");
+        let actual = read_zip_entry(&mut archive, "manifest.json").expect("read deflated receipt export entry");
+        assert_eq!(actual, expected);
+    }
+
     #[test]
     fn audit_status_worst_ordering() {
         assert_eq!(

crates/corecruxd/Cargo.toml

@@ -75,7 +75,7 @@ uuid = { workspace = true, features = ["v4"] }
 url = { workspace = true }
 zeroize = "1.8"
 zstd = { workspace = true }
-zip = { workspace = true, features = ["default"] }
+zip = { workspace = true }
 
 corecrux-frame = { path = "../corecrux-frame" }
 crux-escrow = { path = "../crux-escrow" }