From f7bf09e4395f8af584d5fa553a4434ca5a9cbeda Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:41:45 +0500 Subject: [PATCH 1/2] chore(ci): converge ci-workflows pins on 0.1.24 Previous pins in this repository: ci.yml 1ab6708b,9231ee74; image.yml 9231ee74; security.yml 1ab6708b,9231ee74. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.24 is the convergence target rather than 0.1.23 because 0.1.23 could not be one. Vendoring left five `uses:` pointing at `./actions/...`, which in a called workflow resolves against the caller's workspace instead of ci-workflows, so every cross-repository caller failed at job setup. ci-feedback.yml had carried that defect since 0.1.21 and only surfaced on 2026-09-20 because its job fires solely on a failed conclusion. 0.1.24 names and pins the repository for all five. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.24 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/image.yml | 2 +- .github/workflows/security.yml | 12 ++++++------ 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27e7bdd..275352e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: name: rust permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # Two, not three. Windows is absent because nothing here is built for it: # the deliverable is a Linux container, and macOS is kept because it is @@ -65,7 +65,7 @@ jobs: name: supply-chain permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: enable_audit: true # cargo-deny and cargo-machete are off deliberately, not by omission. @@ -81,7 +81,7 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 pr-hygiene: name: pr-hygiene @@ -90,7 +90,7 @@ jobs: contents: read issues: write # the stale bot closes threads pull-requests: write # the labeler applies labels - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # The stock configuration rejects any body line over 100 characters, and # Dependabot writes a 144-character compare link into every git-ref bump. diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml index 8472de7..4894979 100644 --- a/.github/workflows/image.yml +++ b/.github/workflows/image.yml @@ -70,7 +70,7 @@ jobs: permissions: contents: read packages: write # ghcr.io push and the registry layer cache - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: image: ghcr.io/nddev-opennetwork/nremote-server tags: ${{ needs.plan.outputs.tags }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4ecef74..d54102f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: actions: read # CodeQL reads the workflow definitions it analyses contents: read security-events: write # CodeQL publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: languages: '["rust", "actions"]' queries: security-and-quality @@ -40,7 +40,7 @@ jobs: permissions: contents: read pull-requests: write # writes the review it produces - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: fail_on_severity: moderate @@ -52,13 +52,13 @@ jobs: contents: read id-token: write # mints the OIDC token its publication is signed with security-events: write # Scorecard publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 osv: name: osv permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 zizmor: name: zizmor @@ -66,10 +66,10 @@ jobs: actions: read # the SARIF upload reads this run to attach its results contents: read security-events: write # zizmor publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 secret-scan: name: secret-scan permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 From 6da14d32191f8c3df6f3b0b02fb5409617ec803b Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 04:16:43 +0500 Subject: [PATCH 2/2] fix(deps): raise rustls to 0.23.45 and release the stale rsa hold RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption level boundaries) affects rustls 0.23.43; 0.23.45 carries the fix. The lock moves and nothing else resolves differently. The advisory scan also failed on an unused ignore: `rsa` no longer reaches the lockfile through `sqlx-mysql`, so the RUSTSEC-2023-0071 holds in osv-scanner.toml and .cargo/audit.toml documented a crate that is not there. Both are released; if `rsa` returns, the advisory resurfaces and gets re-argued rather than silently inherited. Signed-off-by: rldyourmnd --- .cargo/audit.toml | 28 +++++++++++----------------- Cargo.lock | 6 +++--- osv-scanner.toml | 19 +++++-------------- 3 files changed, 19 insertions(+), 34 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 839008e..a48d6c0 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -1,23 +1,17 @@ -# One advisory is ignored here. Ignoring is not "accepted risk" by default: it -# is a claim that the vulnerable code is not in what we ship, and the claim has -# to be checkable from this file. +# No advisory is currently ignored here. Ignoring is not "accepted risk" by +# default: it is a claim that the vulnerable code is not in what we ship, and +# the claim has to be checkable from this file. # -# RUSTSEC-2023-0071 -- Marvin attack, a timing side channel in `rsa`. There is -# no patched release; the advisory has been open since 2023 with `patched: []`. -# -# `rsa` reaches this lockfile through `sqlx-mysql`, which `sqlx-macros-core` -# depends on so the compile-time query checker can understand every driver. -# Only the `sqlite` feature is enabled here, so `sqlx-mysql` is never built and -# `rsa` is never linked. `cargo audit` reads the lockfile, which lists optional -# dependencies whether or not their feature is on, so it sees a crate that this -# binary does not contain. -# -# Check the claim rather than trusting this comment: +# The one hold this file used to carry was RUSTSEC-2023-0071 -- the Marvin +# timing side channel in `rsa`, which reached the lockfile through +# `sqlx-mysql` while only the `sqlite` feature was enabled. `rsa` no longer +# resolves at all, so the hold was released rather than kept as an unused +# ignore. # +# If `rsa` ever returns to the lockfile, the claim to re-check is: + # cargo tree -i rsa -e normal # "nothing to print" -- not in the graph # cargo tree -i sqlx-mysql -e normal -# -# If either ever prints a path, this entry is wrong and must go. [advisories] -ignore = ["RUSTSEC-2023-0071"] +ignore = [] diff --git a/Cargo.lock b/Cargo.lock index 161b316..84af154 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3218,9 +3218,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", @@ -3908,7 +3908,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix 1.1.4", "windows-sys 0.61.2", diff --git a/osv-scanner.toml b/osv-scanner.toml index 6d5a607..3a97bb7 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,22 +1,13 @@ -# Six advisories are held here, each with the reason it is held and a date the +# Five advisories are held here, each with the reason it is held and a date the # reason expires. None of them is "we looked and it seemed fine": every entry # either names the code path that does not exist, or names the work that would # close it. # # Thirteen more were closed rather than held, by refreshing the lockfile and -# raising sqlx, tungstenite, flexi_logger, deadpool and users. Holding is the -# exception, not the routine. - -[[IgnoredVulns]] -id = "RUSTSEC-2023-0071" -ignoreUntil = 2026-12-01 -reason = """ -Marvin attack in `rsa`, no patched release since 2023. Reaches the lockfile -through `sqlx-mysql`, which `sqlx-macros-core` depends on so the compile-time -query checker understands every driver. Only the `sqlite` feature is enabled, -so `cargo tree -i rsa -e normal` prints nothing and the crate is not linked. -The same reasoning and the same check are in .cargo/audit.toml. -""" +# raising sqlx, tungstenite, flexi_logger, deadpool and users. A fourteenth, +# RUSTSEC-2023-0071 (`rsa` via `sqlx-mysql`), left the lockfile entirely, so its +# hold was released -- holding an advisory for a crate nothing resolves only +# trips the unused-ignore gate. Holding is the exception, not the routine. [[IgnoredVulns]] id = "RUSTSEC-2025-0141"