From 19d869f588c528cf2ca4fd10968e5349bcd5844a Mon Sep 17 00:00:00 2001 From: Kurdistan Tech Ministry Date: Wed, 22 Apr 2026 16:59:38 +0300 Subject: [PATCH] fix(ci): ignore RUSTSEC-2026-0104 (webpki CRL parsing panic) Transitive dep via kube/rustls. We do not parse CRLs in our P2P/RPC stack. Added to both deny.toml and check-audit.py ignore lists. --- .gitlab/check-audit.py | 3 ++- deny.toml | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitlab/check-audit.py b/.gitlab/check-audit.py index d0032a5e..af880c73 100644 --- a/.gitlab/check-audit.py +++ b/.gitlab/check-audit.py @@ -20,7 +20,8 @@ IGNORE = { # tracing-subscriber 0.2.x: pulled by arkworks internals only "RUSTSEC-2025-0055", # rustls-webpki: transitive via kube-client, upgrade needs kube ecosystem bump - "RUSTSEC-2026-0098", "RUSTSEC-2026-0099", + # We do not use CRLs or rely on certificate name constraints in our P2P/RPC stack. + "RUSTSEC-2026-0098", "RUSTSEC-2026-0099", "RUSTSEC-2026-0104", # rand: unsound only with custom logger calling rand::rng() during init "RUSTSEC-2026-0097", # lru: Stacked Borrows in IterMut, no user-facing exploit path diff --git a/deny.toml b/deny.toml index f6532faf..13150fbe 100644 --- a/deny.toml +++ b/deny.toml @@ -46,10 +46,11 @@ ignore = [ "RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng() # ── webpki ──────────────────────────────────────────────────────────────── - # Name-constraints validation bugs in transitive webpki dep. - # We do not rely on certificate name constraints in our P2P/RPC stack. + # Name-constraints and CRL parsing bugs in transitive webpki dep. + # We do not use CRLs or rely on certificate name constraints in our P2P/RPC stack. "RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted "RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted + "RUSTSEC-2026-0104", # webpki: reachable panic in CRL parsing (onlySomeReasons BIT STRING) ] # License compliance