From 6827a5c02cdd92848d7e13f247db3e9e92b5677d Mon Sep 17 00:00:00 2001 From: autoantohaki Date: Wed, 21 Oct 2026 16:04:50 -0300 Subject: [PATCH 1/3] Fix Linux build: convert rustix errors and satisfy clippy The Unix-only model store used ? on rustix calls whose Errno had no conversion into the crate error, so cargo check failed on Linux and CI on main has been red since. Add the conversion, and take the credential open error by reference so the Unix branch of map_open_error passes clippy without an underscore-prefixed binding. --- crates/impossible-models/src/lib.rs | 7 +++++++ crates/impossible-server-core/src/security.rs | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/crates/impossible-models/src/lib.rs b/crates/impossible-models/src/lib.rs index 69b2f72..57ffbdb 100644 --- a/crates/impossible-models/src/lib.rs +++ b/crates/impossible-models/src/lib.rs @@ -151,6 +151,13 @@ impl From for Error { } } +#[cfg(unix)] +impl From for Error { + fn from(value: rustix::io::Errno) -> Self { + Self::Io(value.into()) + } +} + impl From for Error { fn from(value: reqwest::Error) -> Self { let kind = if value.is_connect() { diff --git a/crates/impossible-server-core/src/security.rs b/crates/impossible-server-core/src/security.rs index b25df83..c8ade72 100644 --- a/crates/impossible-server-core/src/security.rs +++ b/crates/impossible-server-core/src/security.rs @@ -109,7 +109,7 @@ fn open_secret_file(path: &Path) -> Result { let mut options = OpenOptions::new(); options.read(true); configure_no_follow(&mut options); - options.open(path).map_err(map_open_error) + options.open(path).map_err(|error| map_open_error(&error)) } #[cfg(unix)] @@ -136,9 +136,10 @@ fn configure_no_follow(options: &mut OpenOptions) { #[cfg(not(any(unix, windows)))] fn configure_no_follow(_options: &mut OpenOptions) {} -fn map_open_error(_error: std::io::Error) -> CredentialError { +#[cfg_attr(not(unix), allow(unused_variables))] +fn map_open_error(error: &std::io::Error) -> CredentialError { #[cfg(unix)] - if _error.raw_os_error() == Some(libc::ELOOP) { + if error.raw_os_error() == Some(libc::ELOOP) { return CredentialError::Invalid; } CredentialError::Unavailable From 28bd4f8b9f04e6b2df2efe13e70a0f5e49c4137b Mon Sep 17 00:00:00 2001 From: autoantohaki Date: Wed, 21 Oct 2026 16:15:51 -0300 Subject: [PATCH 2/3] Point repository references at impossibleG/impossible-embeddings Cargo metadata, the container OCI labels, the SBOM namespace, the security policy and the release verification command all named impossibleG/impossible-embedding, which does not exist. The documented gh attestation verify --repo command would fail against real release assets, and the image source label pointed to a 404. --- Cargo.toml | 2 +- Dockerfile | 6 +++--- SECURITY.md | 2 +- docs/releasing.md | 2 +- scripts/generate-sbom.ps1 | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 70b52c8..35a3466 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -14,7 +14,7 @@ version = "0.1.0" edition = "2024" rust-version = "1.85" license = "MIT OR Apache-2.0" -repository = "https://github.com/impossibleG/impossible-embedding" +repository = "https://github.com/impossibleG/impossible-embeddings" [workspace.dependencies] anyhow = "1.0.100" diff --git a/Dockerfile b/Dockerfile index 457f400..fb5f610 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,9 +21,9 @@ ARG VERSION=0.0.0-dev ARG REVISION=unknown LABEL org.opencontainers.image.title="Impossible Embedding" \ org.opencontainers.image.description="Local-first server for open embedding models" \ - org.opencontainers.image.source="https://github.com/impossibleG/impossible-embedding" \ - org.opencontainers.image.url="https://github.com/impossibleG/impossible-embedding" \ - org.opencontainers.image.documentation="https://github.com/impossibleG/impossible-embedding/blob/main/docs/operations.md" \ + org.opencontainers.image.source="https://github.com/impossibleG/impossible-embeddings" \ + org.opencontainers.image.url="https://github.com/impossibleG/impossible-embeddings" \ + org.opencontainers.image.documentation="https://github.com/impossibleG/impossible-embeddings/blob/main/docs/operations.md" \ org.opencontainers.image.licenses="MIT OR Apache-2.0" \ org.opencontainers.image.version="$VERSION" \ org.opencontainers.image.revision="$REVISION" diff --git a/SECURITY.md b/SECURITY.md index e4df2fc..8a580fa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -3,7 +3,7 @@ ## Reporting a vulnerability Do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability -reporting for `impossibleG/impossible-embedding` and include affected versions, impact, and minimal +reporting for `impossibleG/impossible-embeddings` and include affected versions, impact, and minimal reproduction steps. Do not include real credentials, private model data, or sensitive request text. This community project does not promise a response time. A supported-version table will be added diff --git a/docs/releasing.md b/docs/releasing.md index b73535e..e01a34d 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -35,7 +35,7 @@ When the release displays a GitHub attestation, verify its keyless signature and ```shell gh attestation verify impossible-embedding-0.1.0-x86_64-unknown-linux-gnu.tar.gz \ - --repo impossibleG/impossible-embedding + --repo impossibleG/impossible-embeddings ``` A checksum detects corruption only when its source is trusted. The attestation additionally binds diff --git a/scripts/generate-sbom.ps1 b/scripts/generate-sbom.ps1 index d016b06..a6bbff2 100644 --- a/scripts/generate-sbom.ps1 +++ b/scripts/generate-sbom.ps1 @@ -172,7 +172,7 @@ $document = [ordered]@{ dataLicense = "CC0-1.0" SPDXID = "SPDXRef-DOCUMENT" name = "impossible-embedding-$($server.version)-$Target-$OnnxRuntimeLinkage" - documentNamespace = "https://github.com/impossibleG/impossible-embedding/sbom/$($server.version)/$Target/$OnnxRuntimeLinkage/$lockDigest" + documentNamespace = "https://github.com/impossibleG/impossible-embeddings/sbom/$($server.version)/$Target/$OnnxRuntimeLinkage/$lockDigest" creationInfo = [ordered]@{ created = $created creators = @("Tool: impossible-embedding/scripts/generate-sbom.ps1") From 17b7d3317070b38660b611bfdbdc6a90220a3417 Mon Sep 17 00:00:00 2001 From: autoantohaki Date: Wed, 21 Oct 2026 16:33:08 -0300 Subject: [PATCH 3/3] Update rustls and webpki crates for new security advisories cargo deny now fails on RUSTSEC-2026-0346, -0347, -0348, -0349 (rustls), -0382 (rustls-webpki) and -0381/-0383 (webpki-roots, webpki-root-certs). These crates back the TLS client used for model downloads. Bump them to the patched releases and regenerate the third-party notices. --- Cargo.lock | 16 ++++++++-------- THIRD_PARTY_LICENSES.txt | 8 ++++---- THIRD_PARTY_NOTICES.md | 8 ++++---- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6165fd3..d014000 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1926,9 +1926,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "once_cell", "ring", @@ -1950,9 +1950,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -2896,18 +2896,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/THIRD_PARTY_LICENSES.txt b/THIRD_PARTY_LICENSES.txt index e7b4cd0..d9ae219 100644 --- a/THIRD_PARTY_LICENSES.txt +++ b/THIRD_PARTY_LICENSES.txt @@ -1278,7 +1278,7 @@ TEXT: a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2 [crate] L TEXT: a6c48161a09acc75a0e25503bab66a731eb5fba5392ed4bb4743e4ba5085327a [crate] LICENSE-Apache-2.0_WITH_LLVM-exception TEXT: 23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3 [crate] LICENSE-MIT -PACKAGE: rustls 0.23.45 +PACKAGE: rustls 0.23.46 DECLARED-LICENSE: Apache-2.0 OR ISC OR MIT UPSTREAM: https://github.com/rustls/rustls TEXT: a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2 [crate] LICENSE-APACHE @@ -1291,7 +1291,7 @@ UPSTREAM: https://github.com/rustls/pki-types TEXT: 45fd05c4865e7c350b98ad7ac50e1b15462d49af4a91e9b0c9dd933dc9a69742 [crate] LICENSE-APACHE TEXT: 9117d922e667125508dde62b02c1f57ed22f5ad21eb536aa2e2d99e1c796e639 [crate] LICENSE-MIT -PACKAGE: rustls-webpki 0.103.15 +PACKAGE: rustls-webpki 0.103.16 DECLARED-LICENSE: ISC UPSTREAM: https://github.com/rustls/webpki TEXT: 5b698ca13897be3afdb7174256fa1574f8c6892b8bea1a66dd6469d3fe27885a [crate] LICENSE @@ -1907,12 +1907,12 @@ UPSTREAM: https://github.com/daxpedda/web-time TEXT: 54a744942eb3fa63a74d8d359989ed6962c04f3f10ff20cfa08ff8aa7efbe4e6 [crate] LICENSE-APACHE TEXT: f428305bbf2e70fbd807af0f3c7ac1b7acfb95311640f451e9d2e48db6d7e96b [crate] LICENSE-MIT -PACKAGE: webpki-root-certs 1.0.9 +PACKAGE: webpki-root-certs 1.0.10 DECLARED-LICENSE: CDLA-Permissive-2.0 UPSTREAM: https://github.com/rustls/webpki-roots TEXT: e271993808fec50ab29350b39539cdec611a9103f827e0aa26d61da70e2d33f8 [crate] LICENSE -PACKAGE: webpki-roots 1.0.9 +PACKAGE: webpki-roots 1.0.10 DECLARED-LICENSE: CDLA-Permissive-2.0 UPSTREAM: https://github.com/rustls/webpki-roots TEXT: e271993808fec50ab29350b39539cdec611a9103f827e0aa26d61da70e2d33f8 [crate] LICENSE diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 835736b..e9158d4 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -199,9 +199,9 @@ The inventory below records declared package licenses. The corresponding copyrig | `ring` | 0.17.14 | `Apache-2.0 AND ISC` | crates.io | | `rustc-hash` | 2.1.3 | `Apache-2.0 OR MIT` | crates.io | | `rustix` | 1.1.4 | `Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT` | crates.io | -| `rustls` | 0.23.45 | `Apache-2.0 OR ISC OR MIT` | crates.io | +| `rustls` | 0.23.46 | `Apache-2.0 OR ISC OR MIT` | crates.io | | `rustls-pki-types` | 1.15.1 | `MIT OR Apache-2.0` | crates.io | -| `rustls-webpki` | 0.103.15 | `ISC` | crates.io | +| `rustls-webpki` | 0.103.16 | `ISC` | crates.io | | `rustversion` | 1.0.23 | `MIT OR Apache-2.0` | crates.io | | `ryu` | 1.0.23 | `Apache-2.0 OR BSL-1.0` | crates.io | | `schannel` | 0.1.29 | `MIT` | crates.io | @@ -294,8 +294,8 @@ The inventory below records declared package licenses. The corresponding copyrig | `wasm-streams` | 0.4.2 | `MIT OR Apache-2.0` | crates.io | | `web-sys` | 0.3.105 | `MIT OR Apache-2.0` | crates.io | | `web-time` | 1.1.0 | `MIT OR Apache-2.0` | crates.io | -| `webpki-root-certs` | 1.0.9 | `CDLA-Permissive-2.0` | crates.io | -| `webpki-roots` | 1.0.9 | `CDLA-Permissive-2.0` | crates.io | +| `webpki-root-certs` | 1.0.10 | `CDLA-Permissive-2.0` | crates.io | +| `webpki-roots` | 1.0.10 | `CDLA-Permissive-2.0` | crates.io | | `winapi` | 0.3.9 | `MIT/Apache-2.0` | crates.io | | `winapi-i686-pc-windows-gnu` | 0.4.0 | `MIT/Apache-2.0` | crates.io | | `winapi-x86_64-pc-windows-gnu` | 0.4.0 | `MIT/Apache-2.0` | crates.io |