From 2ed08c8badb5cedcf9cf88ff62e4b91e457ba72b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:29:56 +0800 Subject: [PATCH] chore(deps): bump p256 from 0.13.2 to 0.14.0 in the dependencies group (#6481) * chore(deps): bump p256 from 0.13.2 to 0.14.0 in the dependencies group Bumps the dependencies group with 1 update: [p256](https://github.com/RustCrypto/elliptic-curves). Updates `p256` from 0.13.2 to 0.14.0 - [Commits](https://github.com/RustCrypto/elliptic-curves/compare/p256/v0.13.2...p256/v0.14.0) --- updated-dependencies: - dependency-name: p256 dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] * update crate version and remove rustfs-mimalloc-sys crate * fix(connect): adapt p256 signing APIs Use the p256 0.14 Generate trait for device key generation and update low-S normalization calls for ecdsa 0.17. Remove an unused object usecase import so warning-deny builds stay clean. Co-Authored-By: heihutu * fix(connect): update p256 canonical signature checks Co-Authored-By: heihutu --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: houseme Co-authored-by: heihutu --- Cargo.lock | 3 +-- Cargo.toml | 2 +- rustfs/Cargo.toml | 5 +---- rustfs/src/app/object_usecase.rs | 1 + rustfs/src/bin/rustfs-cli.rs | 9 ++++----- rustfs/src/connect/identity.rs | 7 +++---- rustfs/src/connect/offline/enrollment.rs | 2 +- rustfs/src/connect/registration.rs | 2 +- rustfs/tests/connect_identity.rs | 10 ++++++---- rustfs/tests/connect_offline_enrollment.rs | 7 ++++--- rustfs/tests/connect_registration.rs | 2 +- 11 files changed, 24 insertions(+), 26 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index be5c34172..decf081e1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9202,7 +9202,7 @@ dependencies = [ "mime_guess", "opentelemetry", "opentelemetry_sdk", - "p256 0.13.2", + "p256 0.14.0", "parking_lot", "percent-encoding", "pin-project-lite", @@ -9235,7 +9235,6 @@ dependencies = [ "rustfs-log-analyzer", "rustfs-madmin", "rustfs-mimalloc", - "rustfs-mimalloc-sys", "rustfs-notify", "rustfs-object-capacity", "rustfs-object-data-cache", diff --git a/Cargo.toml b/Cargo.toml index c09da814e..3a3b8c5d6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -200,6 +200,7 @@ hmac = { version = "0.13.0" } jsonwebtoken = { version = "11.0.0" } openidconnect = { default-features = false, version = "4.0" } pbkdf2 = "0.13.0" +p256 = { version = "0.14.0", features = ["ecdsa", "pkcs8"] } rsa = { version = "=0.10.0-rc.18" } rustls = { default-features = false, version = "0.23.43" } rustls-native-certs = "0.8" @@ -351,7 +352,6 @@ dav-server = "0.11.0" # Performance Analysis and Memory Profiling rustfs-mimalloc = { version = "0.5.0" } -rustfs-mimalloc-sys = { version = "0.5.0" } hotpath = { version = "0.24.0", default-features = false } # Snapshot testing for output format regression detection insta = { version = "1.48" } diff --git a/rustfs/Cargo.toml b/rustfs/Cargo.toml index 03afb5628..3d6ad255a 100644 --- a/rustfs/Cargo.toml +++ b/rustfs/Cargo.toml @@ -245,7 +245,7 @@ rustfs-scanner = { workspace = true } tempfile = { workspace = true } # Connect device identity: P-256 keys, PKCS#10 certificate requests, ES256 proofs. -p256 = { version = "0.13.2", features = ["ecdsa", "pkcs8"] } +p256 = { workspace = true } rcgen = { workspace = true } # Async Runtime and Networking @@ -341,9 +341,6 @@ rustfs-mimalloc = { workspace = true } [target.'cfg(target_os = "linux")'.dependencies] libsystemd.workspace = true -[target.'cfg(not(target_os = "windows"))'.dependencies] -rustfs-mimalloc-sys.workspace = true - [dev-dependencies] uuid = { workspace = true, features = ["v4", "v5", "fast-rng", "macro-diagnostics"] } serial_test = { workspace = true } diff --git a/rustfs/src/app/object_usecase.rs b/rustfs/src/app/object_usecase.rs index 45ec8592b..d57f81ab0 100644 --- a/rustfs/src/app/object_usecase.rs +++ b/rustfs/src/app/object_usecase.rs @@ -18078,6 +18078,7 @@ mod tests { #[serial_test::serial] async fn compressed_delete_requests_update_observed_usage_without_releasing_quota_floor() { use crate::app::storage_api::test::contract::bucket::{BucketOperations as _, DeleteBucketOptions, MakeBucketOptions}; + use crate::app::storage_api::test::data_usage::apply_bucket_usage_memory_overlay; async fn observed_bucket_usage(bucket: &str) -> Option { let mut usage = rustfs_data_usage::DataUsageInfo::default(); diff --git a/rustfs/src/bin/rustfs-cli.rs b/rustfs/src/bin/rustfs-cli.rs index 49d04db72..3d1073100 100644 --- a/rustfs/src/bin/rustfs-cli.rs +++ b/rustfs/src/bin/rustfs-cli.rs @@ -224,13 +224,12 @@ fn sync_directory(directory: &Path) { /// Fills `buffer` with operating-system randomness. /// /// The device nonce must be unpredictable: it is what stops a captured response -/// being replayed as a fresh one. Sourced through p256's pinned rand_core 0.6 -/// rather than the workspace `rand` 0.10, matching `identity.rs`; the two are -/// different crate versions and only the pinned one is on p256's own path. +/// being replayed as a fresh one. Use the workspace rand 0.10 system RNG, +/// matching the rand_core version used by the upgraded crypto stack. fn getrandom(buffer: &mut [u8]) -> Result<(), String> { - use p256::elliptic_curve::rand_core::{OsRng, RngCore as _}; + use rand::{TryRng as _, rngs::SysRng}; - OsRng + SysRng .try_fill_bytes(buffer) .map_err(|error| format!("the operating system random source failed: {error}")) } diff --git a/rustfs/src/connect/identity.rs b/rustfs/src/connect/identity.rs index 2220f4e8c..e9cdbba58 100644 --- a/rustfs/src/connect/identity.rs +++ b/rustfs/src/connect/identity.rs @@ -24,6 +24,7 @@ use base64::Engine as _; use base64::engine::general_purpose::{STANDARD as BASE64_STANDARD, URL_SAFE_NO_PAD as BASE64_URL_NO_PAD}; use p256::ecdsa::signature::Signer as _; use p256::ecdsa::{Signature, SigningKey}; +use p256::elliptic_curve::Generate as _; use p256::pkcs8::{DecodePrivateKey as _, EncodePrivateKey as _, LineEnding}; use sha2::{Digest as _, Sha256}; use zeroize::Zeroizing; @@ -188,10 +189,8 @@ impl std::fmt::Debug for DeviceIdentity { impl DeviceIdentity { /// Generate a fresh P-256 key. pub fn generate() -> Self { - // p256 is pinned to rand_core 0.6 while the workspace `rand` is 0.10, so - // the RNG comes from p256's own re-export rather than the workspace one. Self { - signing_key: SigningKey::random(&mut p256::elliptic_curve::rand_core::OsRng), + signing_key: SigningKey::generate(), } } @@ -249,7 +248,7 @@ impl DeviceIdentity { /// half of the group order before encoding. pub fn sign_registration(&self, transcript: &RegistrationTranscript) -> RegistrationProof { let signature: Signature = self.signing_key.sign(transcript.as_bytes()); - let canonical = signature.normalize_s().unwrap_or(signature); + let canonical = signature.normalize_s(); RegistrationProof { algorithm: PROOF_ALGORITHM.to_string(), diff --git a/rustfs/src/connect/offline/enrollment.rs b/rustfs/src/connect/offline/enrollment.rs index a16fadb39..ebf568070 100644 --- a/rustfs/src/connect/offline/enrollment.rs +++ b/rustfs/src/connect/offline/enrollment.rs @@ -569,7 +569,7 @@ fn sign(key: &DeviceIdentity, tag: &[u8], bytes: &[u8]) -> Result RotationRequest<'a> { .map_err(|_| CredentialValidationError::CertificateRequest)?; let signing_key = SigningKey::from_pkcs8_der(&key).map_err(|_| CredentialValidationError::CertificateRequest)?; let signature: Signature = signing_key.sign(&transcript); - let canonical = signature.normalize_s().unwrap_or(signature); + let canonical = signature.normalize_s(); Ok(Self { protocol_version: PROTOCOL_VERSION, diff --git a/rustfs/tests/connect_identity.rs b/rustfs/tests/connect_identity.rs index 1f070a91f..403632b0f 100644 --- a/rustfs/tests/connect_identity.rs +++ b/rustfs/tests/connect_identity.rs @@ -137,8 +137,9 @@ fn published_proofs_verify_over_locally_rebuilt_transcripts() { .decode(request["proof"]["value"].as_str().expect("vector carries a proof")) .expect("proof decodes"); let signature = p256::ecdsa::Signature::from_slice(&raw).expect("signature parses"); - assert!( - signature.normalize_s().is_none(), + assert_eq!( + signature.normalize_s(), + signature, "vector '{name}' publishes a proof that is already low-S" ); @@ -305,8 +306,9 @@ fn proof_is_a_canonical_low_s_signature_that_verifies() { assert_eq!(raw.len(), 64, "the signature is a fixed-width r || s"); let signature = p256::ecdsa::Signature::from_slice(&raw).expect("signature parses"); - assert!( - signature.normalize_s().is_none(), + assert_eq!( + signature.normalize_s(), + signature, "s must already be in the lower half of the group order" ); diff --git a/rustfs/tests/connect_offline_enrollment.rs b/rustfs/tests/connect_offline_enrollment.rs index e1e9cf0a1..d1b60a9eb 100644 --- a/rustfs/tests/connect_offline_enrollment.rs +++ b/rustfs/tests/connect_offline_enrollment.rs @@ -607,7 +607,7 @@ fn malleated_high_s_signature_is_refused_although_it_verifies_mathematically() { // Step one: the malleated pair really does verify under the signing key, so // a verifier cannot be excused for accepting it on mathematical grounds. let signature = p256::ecdsa::Signature::from_slice(&raw).expect("the malleated signature parses"); - assert!(signature.normalize_s().is_some(), "the malleated signature must be the high-S form"); + assert_ne!(signature.normalize_s(), signature, "the malleated signature must be the high-S form"); let key = verifying_key(field(&published_key("signing"), "publicKey")); let input = signing_input(&domain_tag("enrollmentChallenge"), &signed_octets(&vector["document"])); key.verify(&input, &signature) @@ -713,8 +713,9 @@ fn assert_response_proves_possession(built_envelope: &Value, label: &str) { let bytes = BASE64_URL_NO_PAD.decode(value).expect("signature is base64url"); assert_eq!(bytes.len(), 64, "{label}: the signature is a fixed-width r || s"); let signature = p256::ecdsa::Signature::from_slice(&bytes).expect("signature parses"); - assert!( - signature.normalize_s().is_none(), + assert_eq!( + signature.normalize_s(), + signature, "{label}: this side must never emit the malleated high-S form it refuses to accept" ); diff --git a/rustfs/tests/connect_registration.rs b/rustfs/tests/connect_registration.rs index a1e94030d..f33cf23e6 100644 --- a/rustfs/tests/connect_registration.rs +++ b/rustfs/tests/connect_registration.rs @@ -277,7 +277,7 @@ fn verify_rotation_request(request: &Value, current_public_key: &[u8], fingerpri assert_eq!(encoded.len(), 86); let raw = BASE64_URL_NO_PAD.decode(encoded).expect("proof base64url"); let signature = Signature::from_slice(&raw).expect("fixed-width signature"); - assert!(signature.normalize_s().is_none(), "rotation proof must be low-S"); + assert_eq!(signature.normalize_s(), signature, "rotation proof must be low-S"); let verifying = VerifyingKey::from_public_key_der(current_public_key).expect("current public key"); verifying.verify(&transcript, &signature).expect("rotation proof verifies");