From 4759d3967c61bf3008c261c3c4aee6fcfc1f6e8d Mon Sep 17 00:00:00 2001 From: Kyle Santiago Date: Tue, 20 Oct 2026 19:08:55 -0400 Subject: [PATCH 1/2] Drop a compromised CA root --- backend/Cargo.lock | 16 +++++----------- backend/Cargo.toml | 4 ++-- 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/backend/Cargo.lock b/backend/Cargo.lock index 9bfabb7a..881c8466 100644 --- a/backend/Cargo.lock +++ b/backend/Cargo.lock @@ -1098,7 +1098,7 @@ checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" [[package]] name = "electrum-client" version = "0.25.0" -source = "git+https://github.com/privkeyio/rust-electrum-client?rev=b5c4e202c84e39791e50e92ca576b2ad38bed02e#b5c4e202c84e39791e50e92ca576b2ad38bed02e" +source = "git+https://github.com/privkeyio/rust-electrum-client?rev=bae28010c620dbe9726499cece1f31066cf217bc#bae28010c620dbe9726499cece1f31066cf217bc" dependencies = [ "bitcoin 0.32.11", "byteorder", @@ -1107,7 +1107,7 @@ dependencies = [ "rustls", "serde", "serde_json", - "webpki-roots 0.25.4", + "webpki-roots 1.0.10", "winapi", ] @@ -4694,26 +4694,20 @@ dependencies = [ "rustls-pki-types", ] -[[package]] -name = "webpki-roots" -version = "0.25.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1" - [[package]] name = "webpki-roots" version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/backend/Cargo.toml b/backend/Cargo.toml index d0999c4c..cc85f981 100644 --- a/backend/Cargo.toml +++ b/backend/Cargo.toml @@ -122,11 +122,11 @@ path = "system_tests/blake2b_hardfork_headers.rs" # "data not consumed entirely when explicitly deserializing". # # Both crates are pinned to an immutable rev rather than a branch, since they carry consensus code. -# Each rev is also tagged in its repo (blake2b-hardfork-0.32-v1, blake2b-extended-headers-v1) so a +# Each rev is also tagged in its repo (blake2b-hardfork-0.32-v1, blake2b-extended-headers-v2) so a # force-push cannot orphan it and break every clean build, including the Docker image. # bdk_wallet and bdk_electrum need no fork; they inherit the fix through `bitcoin`. [patch.crates-io] bitcoin = { git = "https://github.com/privkeyio/rust-bitcoin", rev = "e9aa336977e334f29fbe440a0dc0d21fa739fbf6" } -electrum-client = { git = "https://github.com/privkeyio/rust-electrum-client", rev = "b5c4e202c84e39791e50e92ca576b2ad38bed02e" } +electrum-client = { git = "https://github.com/privkeyio/rust-electrum-client", rev = "bae28010c620dbe9726499cece1f31066cf217bc" } # phonenumber needs postcard's std serialization, not embedded heapless atomics. postcard = { path = "vendor/postcard" } From 887b65af570a6ff50c6f87dd666b4f845532d7f9 Mon Sep 17 00:00:00 2001 From: Kyle Santiago Date: Tue, 20 Oct 2026 19:24:20 -0400 Subject: [PATCH 2/2] Drop the compromised emSign roots and intermediates from every trust path --- backend/Cargo.lock | 8 ++++---- backend/Dockerfile | 7 ++++++- backend/osv-scanner.toml | 13 +++++++++++++ 3 files changed, 23 insertions(+), 5 deletions(-) create mode 100644 backend/osv-scanner.toml diff --git a/backend/Cargo.lock b/backend/Cargo.lock index 881c8466..4e1c3cba 100644 --- a/backend/Cargo.lock +++ b/backend/Cargo.lock @@ -3457,9 +3457,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.14" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -4687,9 +4687,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.6" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "804f18a4ac2676ffb4e8b5b5fa9ae38af06df08162314f96a68d2a363e21a8ca" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] diff --git a/backend/Dockerfile b/backend/Dockerfile index 2a850db7..b3c882b0 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -34,10 +34,15 @@ WORKDIR /app # (3 critical); the fix lives only in bookworm-security, not in any base tag. # When Debian publishes a later revision the mirror drops this one and the build # fails loudly, which is the point: bump the pin and re-run the container scan. +# ca-certificates is pinned for the same reason: 20250419~deb12u2 is the first +# bookworm revision that drops emSign ECC Root CA - G3 and AAA Certificate +# Services, whose emSign intermediates have leaked private keys. Earlier +# revisions trust them, and reqwest (native-tls) and the Nostr relays read this +# store. Pinning also busts any cached layer built before that revision. RUN apt-get update && apt-get install -y --only-upgrade \ perl-base=5.36.0-7+deb12u4 \ && apt-get install -y \ - ca-certificates \ + ca-certificates=20250419~deb12u2 \ libssl3 \ libpcre2-8-0 \ && rm -rf /var/lib/apt/lists/* diff --git a/backend/osv-scanner.toml b/backend/osv-scanner.toml new file mode 100644 index 00000000..23746cf2 --- /dev/null +++ b/backend/osv-scanner.toml @@ -0,0 +1,13 @@ +# osv-scanner reads this file only for backend/Cargo.lock; see frontend/osv-scanner.toml. + +# RUSTSEC-2026-0381 covers every webpki-roots release below 1.0.10, so it also +# matches 0.26.11, the compatibility shim tokio-tungstenite requires. The shim's +# whole implementation is `pub use parent::TLS_SERVER_ROOTS`, re-exporting the +# webpki-roots 1.x locked beside it, which is 1.0.10 and carries no affected root. +# Scoped to this one version so a real webpki-roots 1.x below 1.0.10 still fails. +[[PackageOverrides]] +name = "webpki-roots" +version = "0.26.11" +ecosystem = "crates.io" +vulnerability.ignore = true +reason = "Root-less shim re-exporting webpki-roots 1.0.10, which drops emSign ECC Root CA - G3."