fix(stack-auth): refuse TLS chains carrying the compromised eMudhra CA keys

.changeset/auth-emudhra-spki-blocklist.md

@@ -0,0 +1,10 @@
+---
+"@cipherstash/auth": patch
+---
+
+The native binaries now refuse a TLS certificate chain that carries one of the
+eight eMudhra intermediate CA keys reported compromised on 2026-10-17, including
+their Sectigo cross-signs. On Linux the platform verifier checks no revocation,
+so these intermediates were still trusted through the distro CA bundle. Such a
+chain now fails as a revoked certificate. The package's API is unchanged, and
+the WASM build is unaffected because the runtime's `fetch` handles TLS there.

Cargo.toml

@@ -101,6 +101,14 @@ reqwest = { version = "0.13", default-features = false, features = [
   "form",
   "query",
 ] }
+# The TLS stack under reqwest's `rustls` feature, named directly by
+# stack-auth's `tls` module (the SPKI blocklist around the platform
+# verifier) and by stack-kms. They must stay the versions reqwest resolves:
+# `tls_backend_preconfigured` recognises a `ClientConfig` only from the
+# rustls reqwest itself links.
+rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "aws_lc_rs"] }
+rustls-platform-verifier = "0.6"
+rustls-webpki = { version = "0.103", default-features = false, features = ["alloc"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0.132" }
 thiserror = "1.0.56"

packages/stack-auth/Cargo.toml

@@ -60,6 +60,13 @@ zeroize = { workspace = true }
 open = "5.3.2"
 jsonwebtoken = { workspace = true }
 tokio = { workspace = true }
+# The bundled clients' TLS configuration (`tls`): the platform verifier with
+# a compiled-in SPKI blocklist around it. Native only, since on wasm32 reqwest
+# uses the runtime's `fetch`, and only with `http`.
+rustls = { workspace = true, optional = true }
+rustls-platform-verifier = { workspace = true, optional = true }
+# Its library is named `webpki`.
+rustls-webpki = { workspace = true, optional = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 tokio = { version = "1.47.1", default-features = false, features = ["sync"] }
@@ -75,7 +82,13 @@ default = ["http"]
 # native-only and keep the bundled transport, so they need this feature.
 # `StaticTokenStrategy` is a test double behind `test-utils`, not part of
 # the production surface.
-http = ["dep:reqwest", "dep:bytes"]
+http = [
+  "dep:reqwest",
+  "dep:bytes",
+  "dep:rustls",
+  "dep:rustls-platform-verifier",
+  "dep:rustls-webpki",
+]
 test-utils = []
 # Exposes fuzz-only entry points (e.g. `fuzz_decode_claims`) for the cargo-fuzz
 # harnesses in `fuzz/`. A Cargo feature (not `#[cfg(fuzzing)]`) so it is a known

packages/stack-auth/src/lib.rs

@@ -100,6 +100,10 @@ pub use stack_profile::ErrorPayload;
 mod device_client;
 #[cfg(all(feature = "http", not(target_arch = "wasm32")))]
 mod device_code;
+// The bundled reqwest clients' TLS configuration, this crate's and
+// stack-kms's. Native only: on wasm32 the runtime's `fetch` owns TLS.
+#[cfg(all(feature = "http", not(target_arch = "wasm32")))]
+pub mod tls;
 
 #[cfg(any(test, feature = "test-utils"))]
 mod static_token_strategy;