mirror of
https://github.com/block/buzz.git
synced 2026-11-03 16:01:35 +00:00
d676c7b8db
## Summary RustSec published [RUSTSEC-2026-0387](https://rustsec.org/advisories/RUSTSEC-2026-0387) against `crypto-bigint`. Some of its operations meant to be constant-time could compile to code that branches on secret values. Since the advisory came out, `cargo-deny check` reports advisories as failed. That breaks `Security Domain / Security` on `main` and on every PR that runs the Rust security job (for example #8575 and #8579). `crypto-bigint` 0.5.5 came in only through `p256` 0.13 → `elliptic-curve` 0.13 in `buzz-push-gateway`. The advisory has no 0.5.x fix; the patched line is 0.7.6+. This PR moves `buzz-push-gateway` to `p256` 0.14, which uses `crypto-bigint` 0.7.9. | Advisory | Crate | Change | |---|---|---| | [RUSTSEC-2026-0387](https://rustsec.org/advisories/RUSTSEC-2026-0387) | `crypto-bigint` | 0.5.5 → 0.7.9 (via `p256` 0.13.2 → 0.14.0) | **Code changes:** `p256` 0.14 renamed the SEC1 encoder from `ToEncodedPoint::to_encoded_point` to `ToSec1Point::to_sec1_point`. The gateway calls it in two places, both to re-encode an App Attest public key as uncompressed SEC1 bytes. The tests call it in five more. Nothing else in the gateway's API use changed. **Lockfile:** only the `p256` dependency chain changes: `ecdsa`, `elliptic-curve`, `ff`, `group`, `primeorder`, `rfc6979` and `sec1` move up a minor version. `primefield` and `wnaf` are added. The old `der`/`spki`/`pkcs8`/`pem-rfc7468`/`const-oid` 0.x versions that only this chain used are removed. `desktop/src-tauri/Cargo.lock` and the `buzz-feature-flags` fixture lockfile don't contain `crypto-bigint`, so they're unchanged. **Exposure, for context:** in production the gateway uses `p256` only to verify App Attest signatures against public keys. Signing with a private key happens only in tests. So the timing issue didn't realistically apply here, but the bump clears the advisory instead of ignoring it. ### Related issue N/A. I searched open and closed PRs for `RUSTSEC-2026-0387` and `crypto-bigint` and found none. ### Testing - `cargo-deny check`: `advisories ok, bans ok, licenses ok, sources ok`. On `origin/main` the Security job fails on this advisory. - `cargo test -p buzz-push-gateway --all-features`: 82 passed, 18 ignored (the same tests are `#[ignore]` on `main`). - `cargo clippy -p buzz-push-gateway --all-targets --all-features -- -D warnings` is clean. - `cargo check --workspace --all-targets` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Bradley Axen <baxen@squareup.com> Co-authored-by: ART <ea39c1c8acf57180161ef4ba4ed68abf8589f5291956b909a5aa991fc66664ca@buzz.block.builderlab.xyz> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.7 KiB
TOML
59 lines
1.7 KiB
TOML
[package]
|
|
name = "buzz-push-gateway"
|
|
description = "Blind, capability-gated NIP-PL gateway for the Buzz mobile app"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[lib]
|
|
name = "buzz_push_gateway"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "buzz-push-gateway"
|
|
path = "src/main.rs"
|
|
|
|
[features]
|
|
# Personal device development only. Production builds remain production-only.
|
|
personal-dev-app-attest = []
|
|
|
|
[dependencies]
|
|
aes-gcm = "0.10"
|
|
aws-lc-rs = { version = "1", default-features = false }
|
|
minicbor = { version = "0.25", features = ["std", "half"] }
|
|
p256 = { version = "0.14", features = ["ecdsa"] }
|
|
rustls-pki-types = { version = "1", features = ["std"] }
|
|
webpki = { package = "rustls-webpki", version = "0.103.9", default-features = false, features = ["aws-lc-rs", "alloc"] }
|
|
x509-parser = { version = "0.18.1", default-features = false }
|
|
axum = { workspace = true }
|
|
async-trait = "0.1"
|
|
base64 = "0.22"
|
|
chrono = { workspace = true }
|
|
hex = { workspace = true }
|
|
getrandom = "0.4"
|
|
metrics = { workspace = true }
|
|
metrics-exporter-prometheus = { workspace = true }
|
|
nostr = { workspace = true }
|
|
rand = { workspace = true }
|
|
reqwest = { workspace = true, features = ["http2"] }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tower = { workspace = true }
|
|
tower-http = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
url = { workspace = true }
|
|
uuid = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
openssl = { version = "0.10", features = ["vendored"] }
|
|
ciborium = "0.2"
|
|
proptest = { workspace = true }
|
|
reqwest = { workspace = true }
|