Repository navigation
0.103.16: reject cert paths containing distrusted SPKIs - #546
Merged
Merged
Conversation
Match SPKI bytes throughout the path, including leaves and trust anchors against a static list of distrusted keys. Keys that match are rejected as distrusted for path building purposes.
Resolve NOSTD_TARGET through the GitHub Actions env context when passing it to rust-toolchain. The action previously inserted the input into shell source, which expanded the variable. Its updated argument handling preserves the literal value, causing toolchain installation to fail in both no-std jobs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## rel-0.103 #546 +/- ##
=============================================
+ Coverage 97.42% 97.48% +0.06%
=============================================
Files 19 19
Lines 3843 3943 +100
=============================================
+ Hits 3744 3844 +100
Misses 99 99 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
djc
approved these changes
Oct 20, 2026
ctz
approved these changes
Oct 20, 2026
This was referenced Oct 20, 2026
Merged
1 of 4 tasks
1 of 4 tasks
4 tasks done
5 of 7 tasks
This was referenced Oct 20, 2026
Closed
This was referenced Oct 20, 2026
Open
This was referenced Oct 21, 2026
This was referenced Oct 21, 2026
Merged
This was referenced Oct 22, 2026
RUSTSEC-2026-0382: Certificate verification may accept distrusted intermediates
wezterm/wezterm#8274
Open
Open
Open
lbailey94
added a commit
to lbailey94/whitemagic
that referenced
this pull request
Oct 22, 2026
Second half of RUSTSEC-2026-0382 (same emSign distrust issue, announced via rustls/webpki#546): the verifier itself accepted certificate paths through distrusted emSign intermediates. Patched in >= 0.103.16. The preceding commit moved the bundled anchors; this one moves the code that checks them. Both were red on main and are the reason the cargo-deny gate existed without anyone acting on it.
This was referenced Oct 22, 2026
2 of 4 tasks
bsod90
added a commit
to cube-js/cube
that referenced
this pull request
Oct 22, 2026
#12378) eMudhra (emSign) intermediate CA keys were compromised; the rustls stack now refuses them. `webpki-roots` 1.0.10 drops the emSign roots ([rustls/webpki-roots@c644e3e](rustls/webpki-roots@c644e3e)) and `rustls-webpki` 0.103.16 rejects any chain containing the distrusted intermediate keys ([rustls/webpki#546](rustls/webpki#546)). The Node side was fixed by the Node 24.22.1 bump in v1.8.10; the Rust lockfiles were not touched there. Lockfile-only. `webpki-roots` 0.26.11 is the compatibility shim that re-exports 1.x, so moving the 0.26 copies to it pulls 1.0.10 without bumping `reqwest`/`hyper-rustls`. | Lockfile | `webpki-roots` | `rustls-webpki` | |---|---|---| | `rust/cubestore` | 0.26.1 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `rust/cubesql` | 0.26.3 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `packages/cubejs-backend-native` | 0.26.3 → 0.26.11 + 1.0.10 | 0.103.15 → 0.103.16 | | `rust/cube` | 1.0.7 → 1.0.10 | 0.103.13 → 0.103.16 | | `rust/cube-cli` | — | 0.103.13 → 0.103.16 | No other packages move. `webpki-root-certs` is not in any tree. Cube Store's S3/GCS remote FS uses native-tls (the image's system CA store), so it is unaffected by this change. `cargo check --locked` passes in `rust/cubesql` (`--all-targets`), `rust/cube`, `rust/cube-cli` and `packages/cubejs-backend-native`. In `rust/cubestore` the TLS crates compile locally, but the full check stops at a macOS-only `librdkafka` link error, so CI is the check there. **Check List** - [x] Tests have been run in packages where changes have been made if available - [x] Linter has been run for changed code - [ ] Tests for the changes have been added if not covered yet - [ ] Docs have been added / updated if required 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
marcosgabrielgomes110-collab
added a commit
to marcosgabrielgomes110-collab/rmp
that referenced
this pull request
Oct 22, 2026
Fixes the RUSTSEC advisory about distrusted emSign intermediate public keys (rustls/webpki#546). cargo-deny was failing on main. Co-authored-by: CodeMarcos <marcosgabrielgomes110-collab@users.noreply.github.com>
5 of 16 tasks
molexxxx
added a commit
to molexxxx/zero-server
that referenced
this pull request
Oct 22, 2026
RUSTSEC-2026-0382 reports that certificate verification in rustls-webpki 0.103.15 may accept a path through a small set of distrusted intermediate certificates, and cargo deny refuses the locked version. 0.103.16, released 2026-10-20 (https://crates.io/api/v1/crates/rustls-webpki, read 2026-10-22, not yanked), rejects certificate paths that contain those subject public keys. The lockfile moves to it and the vet exemption moves with it; cargo deny on both graphs, cargo vet, the TLS and serve tests and workspace clippy pass. Release notes: https://github.com/rustls/webpki/releases/tag/v%2F0.103.16 Advisory announcement: rustls/webpki#546
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#545 but applied to rel-0.103 to prep 0.103.16.
Proposed release notes:
Distrust a small set of intermediate certificate subject public keys due to specific security concerns around their operation.