Repository navigation
SECURITY: gws, codex, zellij, xh, weathr, yazi, zola, gurk, zizmor, nushell: lock rustls-webpki 0.103.16 (CVE-2026-111943) - #955
Merged
bryan-minimal merged 1 commit intoOct 21, 2026
Conversation
…ushell: lock rustls-webpki 0.103.16 (CVE-2026-111943) These verify TLS against the system store (fixed at runtime by the ca-certificates update), but compile in rustls-webpki < 0.103.16, which lacks the distrust list for the eight compromised eMudhra intermediates (RUSTSEC-2026-0382). Where a webpki-roots / webpki-root-certs is also in the lock it moves to 1.0.10 (RUSTSEC-2026-0383). Same mechanism as the bundled-roots PR: a committed Cargo.lock patch applied by name with `patch -Np1`, a fail-closed version check, and `cargo build --locked`. Seven of the ten also move aws-lc-rs to 1.18.2 / aws-lc-sys to 0.46.0, which rustls-webpki 0.103.16 requires when its aws-lc-rs feature is on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 30 billable files and costs up to $7.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 16 minutes for your next included review. View limit details
Comment |
jtnkminimal
approved these changes
Oct 20, 2026
bryan-minimal
deleted the
security/cve-2026-111943-rustls-webpki-system-roots
branch
October 21, 2026 16:10
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CVE-2026-111943. The private keys of eight eMudhra intermediate CAs are recoverable from their public certificates (Mozilla bug 2083449).
These ten verify TLS against the system store:
rustls-platform-verifier/rustls-native-certs. The ca-certificates rebuild (#948) fixes the roots they see at runtime. But each one compiles inrustls-webpkiolder than 0.103.16 (RUSTSEC-2026-0382), so it lacks the newDISTRUSTED_SPKISblock on the 8 intermediates. A chain through a compromised intermediate still validates wherever a trusted path to it exists.Companion to #953, which covers the packages that bundle roots by default and uses the same mechanism.
Why aws-lc moves:
rustls-webpki0.103.16 requiresaws-lc-rs ^1.18when its aws-lc-rs feature is on, and these locks have rustls's default aws-lc provider. For those I rancargo update -p aws-lc-rs -p aws-lc-sys -p rustls-webpki@<old>, adding-p pkg-configfor zellij, whosecurl-sysheld pkg-config at 0.3.25. Nothing else re-resolved. The other locks are hand edits: theversionandchecksumlines plus the"name version"back-references.codex note: upstream's
codex-rs/Cargo.lockatrust-v0.155.0lists every workspace member as0.0.0, while the tagged Cargo.toml says0.155.0. So that lock was never--locked-clean; our current unlocked build rewrote it in the sandbox. This patch carries those ~150 path-member0.0.0 → 0.155.0lines too, which is why it is long. Its registry changes are only the four crates in the table.No upstream release fixes this yet.
rustls-webpki0.103.16 was published 2026-10-20 08:58 UTC.How
The mechanism is the same as #953:
packages/<p>/cve-2026-111943-webpki-lock.patchis applied by name withpatch -Np1.patchis added as a build dep. codex applies it aftercd codex-rs. zola and nushell apply it before their getrandom shim.rustls-webpki0.103.16 is locked and norustls-webpki0.103.0–15 orwebpki-roots/webpki-root-certs1.0.0–9 remains.cargo build --locked. yazi already used--locked.A version bump that keeps the patch fails at
patch. Drop the patch on the first upstream release that locks 0.103.16, or regenerate it if that release is still unfixed.Verified, and how
url+sha256, and the sha256 matched.patch -Np1to the pristine lock, and the result is byte-identical to the edited lock.cargo metadata --lockedsucceeds on every patched tree. I ran only resolves, never a compile, from outside the downloaded tree.cargo tree -e normal --target x86_64-unknown-linux-gnu -i rustls-webpkiputs rustls-webpki in the Linux normal-dependency graph of all ten.nu-command(feature-gated) → ureq.MINIMAL_SCIENCE_MODE=1 mip dump --packages --arch amd64, diffed against main, changes exactly these 10 spec hashes and nothing downstream.nickel formatleaves every build.ncl unchanged, andsh -npasses.Unverified
minimal buildandminimal-checkare the build verification.pkg-configbuild-dep crate in weathr and zizmor. Only CI shows that it builds in the sandbox.packages/codex/build.sh. The two diffs sit in different hunks, but whichever lands second should re-check.Not in this PR
atuin, typst and maki use native-tls / OpenSSL, with no rustls-webpki in their locks, so the system ca-certificates fix covers them. maki builds a vendored
openssl-src(300.6.1+3.6.3); whether its compiled-inOPENSSLDIRfinds our system bundle is a separate question.🤖 Generated with Claude Code