diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml index 8bdd4de9f..4151f4766 100644 --- a/.github/workflows/unit.yml +++ b/.github/workflows/unit.yml @@ -77,10 +77,10 @@ jobs: - name: Run Audit (FastAuth) working-directory: integration-tests/fastauth run: | - cargo audit --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2023-0052 --ignore RUSTSEC-2022-0093 --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0019 + cargo audit --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2023-0052 --ignore RUSTSEC-2022-0093 --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0019 --ignore RUSTSEC-2024-0344 - name: Run Audit (Chain Signatures) # even if previous audit step fails, run this audit step to ensure all crates are audited if: always() working-directory: integration-tests/chain-signatures run: | - cargo audit --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2023-0052 --ignore RUSTSEC-2022-0093 --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0019 + cargo audit --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2023-0052 --ignore RUSTSEC-2022-0093 --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2024-0019 --ignore RUSTSEC-2024-0344 --ignore RUSTSEC-2022-0093 --ignore RUSTSEC-2024-0346 --ignore RUSTSEC-2024-0347 diff --git a/chain-signatures/Cargo.lock b/chain-signatures/Cargo.lock index 7194fd78e..815b6e42a 100644 --- a/chain-signatures/Cargo.lock +++ b/chain-signatures/Cargo.lock @@ -1806,7 +1806,7 @@ checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" dependencies = [ "cfg-if 1.0.0", "cpufeatures", - "curve25519-dalek-derive", + "curve25519-dalek-derive 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)", "digest 0.10.7", "fiat-crypto", "rand_core 0.6.4", @@ -1815,6 +1815,19 @@ dependencies = [ "zeroize", ] +[[package]] +name = "curve25519-dalek" +version = "4.1.3" +source = "git+https://github.com/dalek-cryptography/curve25519-dalek?rev=5b7082bbc8e0b2106ab0d956064f61fa0f393cdc#5b7082bbc8e0b2106ab0d956064f61fa0f393cdc" +dependencies = [ + "cfg-if 1.0.0", + "cpufeatures", + "curve25519-dalek-derive 0.1.1 (git+https://github.com/dalek-cryptography/curve25519-dalek?rev=5b7082bbc8e0b2106ab0d956064f61fa0f393cdc)", + "fiat-crypto", + "rustc_version", + "subtle", +] + [[package]] name = "curve25519-dalek-derive" version = "0.1.1" @@ -1826,6 +1839,16 @@ dependencies = [ "syn 2.0.68", ] +[[package]] +name = "curve25519-dalek-derive" +version = "0.1.1" +source = "git+https://github.com/dalek-cryptography/curve25519-dalek?rev=5b7082bbc8e0b2106ab0d956064f61fa0f393cdc#5b7082bbc8e0b2106ab0d956064f61fa0f393cdc" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.68", +] + [[package]] name = "darling" version = "0.14.4" @@ -2159,7 +2182,7 @@ version = "2.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871" dependencies = [ - "curve25519-dalek 4.1.3", + "curve25519-dalek 4.1.3 (registry+https://github.com/rust-lang/crates.io-index)", "ed25519 2.2.3", "rand_core 0.6.4", "sha2 0.10.8", @@ -4050,7 +4073,7 @@ dependencies = [ "borsh", "bs58 0.4.0", "c2-chacha", - "curve25519-dalek 4.1.3", + "curve25519-dalek 4.1.3 (registry+https://github.com/rust-lang/crates.io-index)", "derive_more", "ed25519-dalek 2.1.1", "hex 0.4.3", @@ -4076,7 +4099,7 @@ dependencies = [ "blake2 0.10.6", "borsh", "bs58 0.4.0", - "curve25519-dalek 4.1.3", + "curve25519-dalek 4.1.3 (registry+https://github.com/rust-lang/crates.io-index)", "derive_more", "ed25519-dalek 2.1.1", "hex 0.4.3", @@ -8141,10 +8164,9 @@ dependencies = [ [[package]] name = "x25519-dalek" version = "2.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277" +source = "git+https://github.com/dalek-cryptography/curve25519-dalek?rev=5b7082bbc8e0b2106ab0d956064f61fa0f393cdc#5b7082bbc8e0b2106ab0d956064f61fa0f393cdc" dependencies = [ - "curve25519-dalek 4.1.3", + "curve25519-dalek 4.1.3 (git+https://github.com/dalek-cryptography/curve25519-dalek?rev=5b7082bbc8e0b2106ab0d956064f61fa0f393cdc)", "rand_core 0.6.4", ] diff --git a/chain-signatures/Cargo.toml b/chain-signatures/Cargo.toml index 3bfa01926..5b0d24fe0 100644 --- a/chain-signatures/Cargo.toml +++ b/chain-signatures/Cargo.toml @@ -5,3 +5,9 @@ members = [ "node", ] resolver = "2" + +[patch.crates-io] +# TODO: trigger Cargo.lock update for x25519-dalek once they release. +# This fixes https://rustsec.org/advisories/RUSTSEC-2024-0344 by pointing to a commit that includes the fix. +# This fix has yet to be propagated to crates.io so we will patch it instead. +x25519-dalek = { git = "https://github.com/dalek-cryptography/curve25519-dalek", rev = "5b7082bbc8e0b2106ab0d956064f61fa0f393cdc" }