From 91e8ec5ee0adbd7c1628b2ad5cb1f910ab84d9b7 Mon Sep 17 00:00:00 2001 From: Juan Olveira Date: Mon, 7 Sep 2026 16:38:36 +0000 Subject: [PATCH 1/2] deps: pin past the yanked chacha20 0.10.1 `cargo deny check advisories` fails on `main`: the tree carries chacha20 0.10.1, which its author yanked. It comes in through tokio-tungstenite 0.30 -> tungstenite -> rand 0.10.2, which depends on chacha20 directly, so nothing here picked the version and no Cargo.toml edit avoids it. The lockfile moves to the republished 0.10.2. A yank is not a disclosed vulnerability, but the policy denies it because a withdrawn version has no upgrade path and no advisory coverage, and this one is the RNG under the WebSocket stack. The check is a required status, so the failure also blocks every unrelated pull request. Lockfile only, `cargo update -p chacha20`. The same resolution drops the digest/generic-array chain 0.10.1 pulled in and collapses the duplicate cpufeatures and block-buffer versions. `cargo deny check` is clean on all four sets; build and the full test suite pass. --- CHANGELOG.md | 11 ++++++++ Cargo.lock | 80 +++++++++------------------------------------------- 2 files changed, 24 insertions(+), 67 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cb30254..125e325 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 release does — is a v2 change, and upstream's own `sources/spec.md` still describes the field the old way. PROTOCOL.md records the same note beside the deprecation. +### Security +- **`cargo deny check advisories` failed on `main`: the dependency tree carried a yanked + `chacha20 0.10.1`.** It arrives through `tokio-tungstenite 0.30 -> tungstenite -> rand 0.10.2`, + which depends on it directly, so nothing in this crate chose the version and no `Cargo.toml` + change can avoid it — the lockfile is pinned forward to the republished `0.10.2` instead + (`cargo update -p chacha20`, lockfile only; the same update drops the `digest`/`generic-array` + chain `0.10.1` pulled in). A yanked crate is not itself a disclosed vulnerability, but the audit + denies it because a version its own author withdrew has no upgrade path and no advisory coverage, + and this one sits under the WebSocket stack's RNG. The check is a required status, so it also + blocked every unrelated pull request until now. + ### Fixed - **A mirror publisher's `publisher_offset` was applied only by the market-by-price processor**, so top-of-book, midpoint and market-by-order stamped the raw wire `channel_id` into consumer-facing diff --git a/Cargo.lock b/Cargo.lock index 289a608..d8e4f29 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -91,15 +91,6 @@ version = "2.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a" -[[package]] -name = "block-buffer" -version = "0.10.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" -dependencies = [ - "generic-array", -] - [[package]] name = "block-buffer" version = "0.12.1" @@ -169,12 +160,12 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures", "rand_core 0.10.1", ] @@ -239,15 +230,6 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" -[[package]] -name = "cpufeatures" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] - [[package]] name = "cpufeatures" version = "0.3.0" @@ -257,16 +239,6 @@ dependencies = [ "libc", ] -[[package]] -name = "crypto-common" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" -dependencies = [ - "generic-array", - "typenum", -] - [[package]] name = "crypto-common" version = "0.2.2" @@ -283,9 +255,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures", "curve25519-dalek-derive", - "digest 0.11.3", + "digest", "fiat-crypto", "rustc_version", "subtle", @@ -320,25 +292,15 @@ dependencies = [ "syn 1.0.109", ] -[[package]] -name = "digest" -version = "0.10.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" -dependencies = [ - "block-buffer 0.10.4", - "crypto-common 0.1.7", -] - [[package]] name = "digest" version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ - "block-buffer 0.12.1", + "block-buffer", "const-oid", - "crypto-common 0.2.2", + "crypto-common", ] [[package]] @@ -518,16 +480,6 @@ dependencies = [ "slab", ] -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -1126,7 +1078,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" dependencies = [ "rand_chacha", - "rand_core", + "rand_core 0.9.5", ] [[package]] @@ -1147,7 +1099,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" dependencies = [ "ppv-lite86", - "rand_core", + "rand_core 0.9.5", ] [[package]] @@ -1419,8 +1371,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", - "digest 0.11.3", + "cpufeatures", + "digest", ] [[package]] @@ -1430,8 +1382,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", - "digest 0.11.3", + "cpufeatures", + "digest", ] [[package]] @@ -1876,12 +1828,6 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65" -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - [[package]] name = "want" version = "0.3.1" From 526d2c516320a4b58dd45af4ea989c67b3b3eb2a Mon Sep 17 00:00:00 2001 From: Juan Olveira Date: Fri, 11 Sep 2026 13:31:55 +0000 Subject: [PATCH 2/2] deps: record that the lock repair is what unblocked the image publishes The regeneration this PR makes for the yanked chacha20 also repairs a Cargo.lock that Cargo refuses with --locked, which had been failing every GHCR publish since 2026-09-08 and left :mainnet-beta on the 0.38.0 client base across the doublezero v0.39.0 release. The changelog entry is what ships, and "pin past a yanked crate" does not explain that to a later reader. --- CHANGELOG.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 125e325..997d2b3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 and this one sits under the WebSocket stack's RNG. The check is a required status, so it also blocked every unrelated pull request until now. + ⚠️ **The same regeneration repairs a `Cargo.lock` that Cargo had been refusing outright, which is + why the image publishes had stopped.** Six Dependabot PRs merged within about thirty seconds on + 2026-09-07 without being rebased onto one another: the ed25519-dalek 3 upgrade resolved a lock + with a single `rand_core` and dropped the old `digest 0.10` chain, while the rust-minor-patch + group was resolved against the tree that still had both. Each lock was correct against its own + base and git merged them line by line with no conflict, leaving `rand 0.9.4` and + `rand_chacha 0.9.0` naming a bare `rand_core` while two versions of it were locked — a name Cargo + cannot resolve — plus six entries reachable from nothing. `cargo build --workspace` passes on that + lock because CI does not use `--locked`; the Dockerfile's `cargo build --release --locked` does, + so the only thing that noticed was the image build. Every GHCR publish failed from 2026-09-08 + onward, and `doublezero-edge-connect:mainnet-beta` sat on the 0.38.0 client base across the + doublezero v0.39.0 release and the `mainnet-beta-0.39.0-1` base image published after it. No + reachable package changes version here beyond `chacha20`; the rest of the diff is those six + orphans and the names they had made ambiguous. + ### Fixed - **A mirror publisher's `publisher_offset` was applied only by the market-by-price processor**, so top-of-book, midpoint and market-by-order stamped the raw wire `channel_id` into consumer-facing