From d89e424b520730d18d66e59211eecac8e60133a3 Mon Sep 17 00:00:00 2001 From: koala Date: Tue, 10 Nov 2026 16:41:00 +0800 Subject: [PATCH] fix(deps): take the patched ctutils; record why three advisories stay New RustSec advisories failed cargo audit in CI. A semver-compatible update clears one: - ctutils 0.4.8 (RUSTSEC-2026-0385, non-constant-time masks), under digest 0.11 in the hpke-rs provider; lockfile only The other three cannot move now and are ignored with their reasons: - crypto-bigint 0.5.5 (RUSTSEC-2026-0387) comes from elliptic-curve 0.13 under the openmls crypto crates, which still require p256 0.13 in 0.6.0. TapChat's only MLS suite is X25519/Ed25519, and openmls rejects a Welcome in another suite before opening it, so the NIST-curve code sees only the public inputs of a peer KeyPackage's signature check. - libsqlite3-sys 0.30.1 (RUSTSEC-2026-0459): TapChat builds the bundled SQLCipher, and the "patched" 0.39 still builds it from SQLite 3.53.4, so a rusqlite 0.41 upgrade would quiet the check without fixing the build. The bug needs a database and -wal written by someone else, and TapChat opens only its own state.db. - zip 4.6.1 (RUSTSEC-2026-0429) aborts in ZipArchive::extract(), on Windows too, and the updater calls extract() on a zip bundle. It does so only after download() has verified the signature, and TapChat's Windows updates are the signed .msi and -setup.exe, never a zip. tauri-plugin-updater 2.14.1 moved to zip ^9 but also moves tauri to 2.12; the four zip entries go when the lockfile takes it. cargo-deny does not read .cargo/audit.toml, so deny.toml ignores the two whose crates are in its graph (crypto-bigint, libsqlite3-sys). Co-Authored-By: Claude Opus 5.5 --- .cargo/audit.toml | 49 +++++++++++++++++++++++++++++++++++++++++------ Cargo.lock | 4 ++-- deny.toml | 6 ++++++ 3 files changed, 51 insertions(+), 8 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 19c5a30..ebd15e3 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -7,13 +7,47 @@ # feature (tauri-plugin-log -> byte-unit -> rust_decimal). It is absent from the # production feature graph. Remove this entry when rust_decimal no longer locks # the vulnerable optional version. -# zip 4 is pulled in by tauri-plugin-updater (2.14.0 still requires zip ^4), -# and only on Windows. Its three advisories concern what extraction does with -# a malicious archive: Unix permission bits (SUID/SGID, modes through +# zip 4 is pulled in by tauri-plugin-updater, and only on Windows. The locked +# 2.10.1 requires zip ^4; 2.14.1 is the first on zip ^9, and taking it also +# moves tauri to >= 2.12. The updater extracts only a bundle whose signature +# download() has already verified, and the desktop installs only via +# downloadAndInstall. Three of the advisories concern what extraction does +# with a malicious archive: Unix permission bits (SUID/SGID, modes through # symlinks), which Windows does not have, and symlink targets outside the -# destination. The updater extracts only a bundle whose signature download() -# has already verified, and the desktop installs only via downloadAndInstall. -# Remove these entries when the updater accepts zip >= 9. +# destination. RUSTSEC-2026-0429 does apply on Windows: ZipArchive::extract() +# aborts the process on a symlink entry that declares a huge size, and the +# updater calls extract() when the verified bundle is a zip. TapChat ships its +# Windows updates as the signed .msi and -setup.exe themselves +# (createUpdaterArtifacts: true), so no genuine update takes that branch, and +# a zip that passes verification needs the signing key, which could ship any +# installer. Remove these entries when Cargo.lock takes tauri-plugin-updater +# >= 2.14.1. +# crypto-bigint 0.5 comes in through elliptic-curve 0.13 (p256, p384, k256), +# which openmls_rust_crypto, openmls_basic_credential and the vendored +# hpke-rs-rust-crypto require; the openmls crates still require p256 0.13 in +# their newest release, 0.6.0. TapChat's only MLS ciphersuite is +# MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519: the device key that signs +# every KeyPackage, Welcome and commit is Ed25519, and HPKE runs on X25519, +# both in curve25519 crates that do not use crypto-bigint. openmls rejects a +# Welcome in another suite before it opens the group secrets, so no TapChat +# secret reaches the NIST-curve code. That code runs only when +# KeyPackage::validate() checks the signature on a peer KeyPackage in another +# suite, on public inputs, and verify_key_package_is_peer_device() then +# rejects it for not carrying the peer's Ed25519 device key. Remove this entry +# when the openmls crypto crates move to elliptic-curve 0.14 (crypto-bigint +# >= 0.7.6). +# libsqlite3-sys 0.30 is rusqlite's, built with +# bundled-sqlcipher-vendored-openssl, so the code at issue is the SQLite inside +# SQLCipher. The libsqlite3-sys releases the advisory marks patched (0.39.x, +# for rusqlite 0.41) still build that feature from sqlcipher-src =419.0.6, +# which bundles the affected SQLite 3.53.4: upgrading would quiet this check +# without fixing the build. The bug needs a database and -wal pair written by a +# less trusted party. TapChat opens only state.db (WAL mode) in the profile it +# unlocks, a file it creates itself, and neither the desktop nor the CLI +# imports a database. Planting a -wal beside it takes write access to the +# user's profile directory. Remove this entry, and take that rusqlite upgrade, +# when a libsqlite3-sys release builds bundled-sqlcipher on SQLite >= 3.54 +# (sqlcipher-src >= 420). ignore = [ "RUSTSEC-2026-0194", "RUSTSEC-2026-0195", @@ -21,6 +55,9 @@ ignore = [ "RUSTSEC-2026-0367", "RUSTSEC-2026-0368", "RUSTSEC-2026-0369", + "RUSTSEC-2026-0387", + "RUSTSEC-2026-0429", + "RUSTSEC-2026-0459", ] informational_warnings = ["unmaintained", "unsound"] diff --git a/Cargo.lock b/Cargo.lock index 35a5789..c2b09e3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1203,9 +1203,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "261af4dc7a06ea8a527a8717d8cbba3417530d6ea14e1edb3de6b67806be474f" dependencies = [ "cmov", ] diff --git a/deny.toml b/deny.toml index 7d4635d..7c76446 100644 --- a/deny.toml +++ b/deny.toml @@ -5,6 +5,12 @@ all-features = false yanked = "deny" unmaintained = "workspace" unsound = "workspace" +# The reasoning for each entry is in .cargo/audit.toml. Only advisories on +# crates in this graph are listed; it leaves out the desktop's gui feature. +ignore = [ + { id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5 only under P-256/P-384/K-256, which TapChat's X25519/Ed25519 MLS suite never uses on secrets" }, + { id = "RUSTSEC-2026-0459", reason = "patched libsqlite3-sys still builds SQLCipher on SQLite 3.53.4; TapChat opens only its own state.db" }, +] [bans] multiple-versions = "warn"