viirya opened a new pull request, #55: URL: https://github.com/apache/spark-connect-gateway/pull/55
### What changes were proposed in this pull request? Add RUSTSEC-2026-0387 (`crypto-bigint`) to the ignore list in `.cargo/audit.toml`, next to RUSTSEC-2023-0071 (`rsa`), with the reasoning and a pointer to SPARK-60591. SPARK-60591 also serves as the tracking issue for this ignore, in the same role SPARK-60369 has for `rsa`, so it should **stay open when this is merged**. It lists the conditions for removing the entry. ### Why are the changes needed? `cargo audit` reports RUSTSEC-2026-0387 against `crypto-bigint` 0.5.5: timing variability in operations intended to be constant-time (published 2026-10-23). Once SPARK-60590 (#54) lands, it is the scheduled audit run's only remaining failure. **No fix is reachable.** The fix is in `crypto-bigint` 0.7.6. The crate arrives through jsonwebtoken's `rust_crypto` provider: `p256` / `p384` (ES256 / ES384) -> `ecdsa` 0.16 -> `elliptic-curve` 0.13 -> `crypto-bigint` 0.5. jsonwebtoken 11 (#39) resolves the same versions, so upgrading it does not help. **The exposure is low**, for the same reason as `rsa`. Timing variability in constant-time arithmetic matters when the operands are secret, i.e. in private-key operations. Production code only verifies signatures with public keys: it uses `DecodingKey` (`from_ec_pem`, `from_ec_components`, and the RSA, Ed25519 and HMAC equivalents), and every `EncodingKey` or signing use is inside `#[cfg(test)]`. A longer-term option that would remove both this advisory and the `rsa` one is jsonwebtoken's `aws_lc_rs` provider, which drops the RustCrypto `rsa` and `elliptic-curve` stacks. It brings a C build dependency (aws-lc needs cmake) and new licenses to review, which SPARK-59552 deliberately avoided, so it is not proposed here. ### Does this PR introduce _any_ user-facing change? No. CI configuration only. ### How was this patch tested? The ignore is by advisory ID, so it covers nothing else. Checked with `cargo audit` and the new config: | Lockfile | Result | |---|---| | `main`'s | exit 1: `crypto-bigint` and `rsa` ignored; the two webpki advisories fixed by #54 still reported | | #54's (i.e. `main` once both land) | **exit 0**: no vulnerabilities, only the unmaintained (`unsafe-libyaml`) and yanked (`chacha20`) warnings, which do not fail the run | So with this and #54 merged, the scheduled run on `main` turns green. ### Was this patch authored or co-authored using generative AI tooling? Yes, co-authored with Claude Code. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
