Skip to content

fix(deps): Distrust revoked eMudhra certificates - #686

Merged
Firestar99 merged 2 commits into
Rust-GPU:mainfrom
hashcatHitman:emudhra-we-have-a-problem
Oct 27, 2026
Merged

fix(deps): Distrust revoked eMudhra certificates#686
Firestar99 merged 2 commits into
Rust-GPU:mainfrom
hashcatHitman:emudhra-we-have-a-problem

Conversation

@hashcatHitman

@hashcatHitman hashcatHitman commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

To address the recently revoked eMudhra certificates, this PR bumps rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10.

See also:

@hashcatHitman
fix(deps): Bump rustls-webpki to 0.103.16
58eabe9 
Update performed via:

```bash
cargo update --precise 0.103.16 rustls-webpki@0.103.15
````

Then I manually reverted a change it made to the version of `getrandom`
used by `tempfile` (it downgrades it from 0.4.3 to 0.3.4, for some
reason).

Fixes RUSTSEC-2026-0382.
See: https://rustsec.org/advisories/RUSTSEC-2026-0382

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
@Firestar99
Firestar99 enabled auto-merge October 25, 2026 18:17
@hashcatHitman
fix(deps): Bump webpki-root-certs to 1.0.10
1d1ff41 
Update performed via:

```bash
cargo update --precise 1.0.10 webpki-root-certs@1.0.9
````

Fixes RUSTSEC-2026-0383.
See: https://rustsec.org/advisories/RUSTSEC-2026-0383

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
auto-merge was automatically disabled October 27, 2026 04:47

Head branch was pushed to by a user without write access

@hashcatHitman
hashcatHitman force-pushed the emudhra-we-have-a-problem branch from 48c227b to 1d1ff41 Compare October 27, 2026 04:47
@hashcatHitman

hashcatHitman commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

(I force pushed nothing to see if it would re-run CI, since merging was blocked on what looked like flaky failures: https://github.com/Rust-GPU/rust-gpu/actions/runs/40137842820/job/121250812445)

@Firestar99

Firestar99 commented Oct 27, 2026

Copy link
Copy Markdown
Member

Cause you don't have a commit in main, I have to approve every run you schedule.

On blast radius

The only thing depending on root CA stuff is cargo-gpu -> cargo-generate, so it only affects cargo-gpu generate. Updating the lockfile would only make cargo run -p cargo-gpu generate on a local checkout "safer" to run. But most users likely just cargo install cargo-gpu from crates, which without --locked would pull in the new root CAs anyway. So the best thing you can do to stay up-to-date is to reinstall cargo-gpu, and you should probably reinstall cargo-binstall as well.

@Firestar99
Firestar99 enabled auto-merge October 27, 2026 09:18
@Firestar99
Firestar99 disabled auto-merge October 27, 2026 09:23
@Firestar99
Firestar99 added this pull request to the merge queue Oct 27, 2026
Merged via the queue into Rust-GPU:main with commit 60d1e25 Oct 27, 2026
24 checks passed
@hashcatHitman

hashcatHitman commented Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

But most users likely just cargo install cargo-gpu from crates, which without --locked would pull in the new root CAs anyway.

I don't believe that's true anymore, as per rust-lang/cargo#17388.

@hashcatHitman
hashcatHitman deleted the emudhra-we-have-a-problem branch October 27, 2026 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Firestar99 Firestar99 Firestar99 approved these changes
@eddyb eddyb Awaiting requested review from eddyb eddyb is a code owner
@LegNeato LegNeato Awaiting requested review from LegNeato LegNeato is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hashcatHitman @Firestar99