chore(deps): bump p256 from 0.13.2 to 0.14.0 in the dependencies group (#6481)

* chore(deps): bump p256 from 0.13.2 to 0.14.0 in the dependencies group

Bumps the dependencies group with 1 update: [p256](https://github.com/RustCrypto/elliptic-curves).


Updates `p256` from 0.13.2 to 0.14.0
- [Commits](https://github.com/RustCrypto/elliptic-curves/compare/p256/v0.13.2...p256/v0.14.0)

---
updated-dependencies:
- dependency-name: p256
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* update crate version and remove rustfs-mimalloc-sys crate

* fix(connect): adapt p256 signing APIs

Use the p256 0.14 Generate trait for device key generation and update low-S normalization calls for ecdsa 0.17.

Remove an unused object usecase import so warning-deny builds stay clean.

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix(connect): update p256 canonical signature checks

Co-Authored-By: heihutu <heihutu@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: heihutu <heihutu@gmail.com>

Cargo.lock

@@ -9202,7 +9202,7 @@ dependencies = [
  "mime_guess",
  "opentelemetry",
  "opentelemetry_sdk",
- "p256 0.13.2",
+ "p256 0.14.0",
  "parking_lot",
  "percent-encoding",
  "pin-project-lite",
@@ -9235,7 +9235,6 @@ dependencies = [
  "rustfs-log-analyzer",
  "rustfs-madmin",
  "rustfs-mimalloc",
- "rustfs-mimalloc-sys",
  "rustfs-notify",
  "rustfs-object-capacity",
  "rustfs-object-data-cache",

Cargo.toml

@@ -200,6 +200,7 @@ hmac = { version = "0.13.0" }
 jsonwebtoken = { version = "11.0.0" }
 openidconnect = { default-features = false, version = "4.0" }
 pbkdf2 = "0.13.0"
+p256 = { version = "0.14.0", features = ["ecdsa", "pkcs8"] }
 rsa = { version = "=0.10.0-rc.18" }
 rustls = { default-features = false, version = "0.23.43" }
 rustls-native-certs = "0.8"
@@ -351,7 +352,6 @@ dav-server = "0.11.0"
 
 # Performance Analysis and Memory Profiling
 rustfs-mimalloc = { version = "0.5.0" }
-rustfs-mimalloc-sys = { version = "0.5.0" }
 hotpath = { version = "0.24.0", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }

rustfs/Cargo.toml

@@ -245,7 +245,7 @@ rustfs-scanner = { workspace = true }
 tempfile = { workspace = true }
 
 # Connect device identity: P-256 keys, PKCS#10 certificate requests, ES256 proofs.
-p256 = { version = "0.13.2", features = ["ecdsa", "pkcs8"] }
+p256 = { workspace = true }
 rcgen = { workspace = true }
 
 # Async Runtime and Networking
@@ -341,9 +341,6 @@ rustfs-mimalloc = { workspace = true }
 [target.'cfg(target_os = "linux")'.dependencies]
 libsystemd.workspace = true
 
-[target.'cfg(not(target_os = "windows"))'.dependencies]
-rustfs-mimalloc-sys.workspace = true
-
 [dev-dependencies]
 uuid = { workspace = true, features = ["v4", "v5", "fast-rng", "macro-diagnostics"] }
 serial_test = { workspace = true }

rustfs/src/app/object_usecase.rs

@@ -18078,6 +18078,7 @@ mod tests {
     #[serial_test::serial]
     async fn compressed_delete_requests_update_observed_usage_without_releasing_quota_floor() {
         use crate::app::storage_api::test::contract::bucket::{BucketOperations as _, DeleteBucketOptions, MakeBucketOptions};
+        use crate::app::storage_api::test::data_usage::apply_bucket_usage_memory_overlay;
 
         async fn observed_bucket_usage(bucket: &str) -> Option<u64> {
             let mut usage = rustfs_data_usage::DataUsageInfo::default();

rustfs/src/bin/rustfs-cli.rs

@@ -224,13 +224,12 @@ fn sync_directory(directory: &Path) {
 /// Fills `buffer` with operating-system randomness.
 ///
 /// The device nonce must be unpredictable: it is what stops a captured response
-/// being replayed as a fresh one. Sourced through p256's pinned rand_core 0.6
+/// being replayed as a fresh one. Use the workspace rand 0.10 system RNG,
-/// rather than the workspace `rand` 0.10, matching `identity.rs`; the two are
+/// matching the rand_core version used by the upgraded crypto stack.
-/// different crate versions and only the pinned one is on p256's own path.
 fn getrandom(buffer: &mut [u8]) -> Result<(), String> {
-    use p256::elliptic_curve::rand_core::{OsRng, RngCore as _};
+    use rand::{TryRng as _, rngs::SysRng};
 
-    OsRng
+    SysRng
         .try_fill_bytes(buffer)
         .map_err(|error| format!("the operating system random source failed: {error}"))
 }

rustfs/src/connect/identity.rs

@@ -24,6 +24,7 @@ use base64::Engine as _;
 use base64::engine::general_purpose::{STANDARD as BASE64_STANDARD, URL_SAFE_NO_PAD as BASE64_URL_NO_PAD};
 use p256::ecdsa::signature::Signer as _;
 use p256::ecdsa::{Signature, SigningKey};
+use p256::elliptic_curve::Generate as _;
 use p256::pkcs8::{DecodePrivateKey as _, EncodePrivateKey as _, LineEnding};
 use sha2::{Digest as _, Sha256};
 use zeroize::Zeroizing;
@@ -188,10 +189,8 @@ impl std::fmt::Debug for DeviceIdentity {
 impl DeviceIdentity {
     /// Generate a fresh P-256 key.
     pub fn generate() -> Self {
-        // p256 is pinned to rand_core 0.6 while the workspace `rand` is 0.10, so
-        // the RNG comes from p256's own re-export rather than the workspace one.
         Self {
-            signing_key: SigningKey::random(&mut p256::elliptic_curve::rand_core::OsRng),
+            signing_key: SigningKey::generate(),
         }
     }
 
@@ -249,7 +248,7 @@ impl DeviceIdentity {
     /// half of the group order before encoding.
     pub fn sign_registration(&self, transcript: &RegistrationTranscript) -> RegistrationProof {
         let signature: Signature = self.signing_key.sign(transcript.as_bytes());
-        let canonical = signature.normalize_s().unwrap_or(signature);
+        let canonical = signature.normalize_s();
 
         RegistrationProof {
             algorithm: PROOF_ALGORITHM.to_string(),

rustfs/src/connect/offline/enrollment.rs

@@ -569,7 +569,7 @@ fn sign(key: &DeviceIdentity, tag: &[u8], bytes: &[u8]) -> Result<String, Enroll
     let signing_key = SigningKey::from_pkcs8_der(pkcs8.as_slice()).map_err(|_| EnrollmentError::ResponseNotProduced)?;
 
     let signature: Signature = signing_key.sign(&signature_input(tag, bytes));
-    let canonical = signature.normalize_s().unwrap_or(signature);
+    let canonical = signature.normalize_s();
 
     Ok(BASE64_URL_NO_PAD.encode(canonical.to_bytes()))
 }

rustfs/src/connect/registration.rs

@@ -202,7 +202,7 @@ impl<'a> RotationRequest<'a> {
             .map_err(|_| CredentialValidationError::CertificateRequest)?;
         let signing_key = SigningKey::from_pkcs8_der(&key).map_err(|_| CredentialValidationError::CertificateRequest)?;
         let signature: Signature = signing_key.sign(&transcript);
-        let canonical = signature.normalize_s().unwrap_or(signature);
+        let canonical = signature.normalize_s();
 
         Ok(Self {
             protocol_version: PROTOCOL_VERSION,

rustfs/tests/connect_identity.rs

@@ -137,8 +137,9 @@ fn published_proofs_verify_over_locally_rebuilt_transcripts() {
             .decode(request["proof"]["value"].as_str().expect("vector carries a proof"))
             .expect("proof decodes");
         let signature = p256::ecdsa::Signature::from_slice(&raw).expect("signature parses");
-        assert!(
+        assert_eq!(
-            signature.normalize_s().is_none(),
+            signature.normalize_s(),
+            signature,
             "vector '{name}' publishes a proof that is already low-S"
         );
 
@@ -305,8 +306,9 @@ fn proof_is_a_canonical_low_s_signature_that_verifies() {
     assert_eq!(raw.len(), 64, "the signature is a fixed-width r || s");
 
     let signature = p256::ecdsa::Signature::from_slice(&raw).expect("signature parses");
-    assert!(
+    assert_eq!(
-        signature.normalize_s().is_none(),
+        signature.normalize_s(),
+        signature,
         "s must already be in the lower half of the group order"
     );
 

rustfs/tests/connect_offline_enrollment.rs

@@ -607,7 +607,7 @@ fn malleated_high_s_signature_is_refused_although_it_verifies_mathematically() {
     // Step one: the malleated pair really does verify under the signing key, so
     // a verifier cannot be excused for accepting it on mathematical grounds.
     let signature = p256::ecdsa::Signature::from_slice(&raw).expect("the malleated signature parses");
-    assert!(signature.normalize_s().is_some(), "the malleated signature must be the high-S form");
+    assert_ne!(signature.normalize_s(), signature, "the malleated signature must be the high-S form");
     let key = verifying_key(field(&published_key("signing"), "publicKey"));
     let input = signing_input(&domain_tag("enrollmentChallenge"), &signed_octets(&vector["document"]));
     key.verify(&input, &signature)
@@ -713,8 +713,9 @@ fn assert_response_proves_possession(built_envelope: &Value, label: &str) {
     let bytes = BASE64_URL_NO_PAD.decode(value).expect("signature is base64url");
     assert_eq!(bytes.len(), 64, "{label}: the signature is a fixed-width r || s");
     let signature = p256::ecdsa::Signature::from_slice(&bytes).expect("signature parses");
-    assert!(
+    assert_eq!(
-        signature.normalize_s().is_none(),
+        signature.normalize_s(),
+        signature,
         "{label}: this side must never emit the malleated high-S form it refuses to accept"
     );
 

rustfs/tests/connect_registration.rs

@@ -277,7 +277,7 @@ fn verify_rotation_request(request: &Value, current_public_key: &[u8], fingerpri
     assert_eq!(encoded.len(), 86);
     let raw = BASE64_URL_NO_PAD.decode(encoded).expect("proof base64url");
     let signature = Signature::from_slice(&raw).expect("fixed-width signature");
-    assert!(signature.normalize_s().is_none(), "rotation proof must be low-S");
+    assert_eq!(signature.normalize_s(), signature, "rotation proof must be low-S");
     let verifying = VerifyingKey::from_public_key_der(current_public_key).expect("current public key");
     verifying.verify(&transcript, &signature).expect("rotation proof verifies");