chore(deps): weekly batch — crypto

Merged
BN
10d ago
+75-131

Rebased status (9f0cbe56c, onto latest public/main f38c59598). PR #571 is still open and is not merged.

Conflict resolution kept current public/main/#572-and-later changes everywhere except the selected crypto upgrades required by this batch:

  • Kept: aes 0.9, cbc 0.2, cipher 0.5, rcgen 0.14, and x509-parser 0.18.
  • Kept main's rand 0.10 and rsa 0.9 getrandom feature, plus base64 0.23, similar 3, and cron 0.17; the branch's unrelated alternatives were not retained.
  • The direct sha1/sha2/hmac/hkdf bumps remain excluded because rsa 0.9 uses digest 0.10. Their direct workspace versions remain main's sha1/sha2 0.10 and hmac 0.12; no digest-0.11 signing or wrapping was reintroduced.
  • Cargo.lock was regenerated for the resolved dependency graph. No supply-chain policy files were changed.

Final diff paths: Cargo.lock, Cargo.toml, crates/preloop-gha-protocol/src/crypto.rs, and crates/preloop-runner-server/src/bootstrap.rs.

Benchmark scope: no benchmark files are changed by the final #571 diff, and no benchmark hash/image/tag updates were retained. The compile-only #572 edits already present on main remain in benchmarks/control-load/src/main.rs, benchmarks/control-load/src/runner.rs, benchmarks/control-load/src/workload.rs, and benchmarks/preloop-perf/Cargo.toml.

Verification previously run on the crypto-only commit (the rebase onto f38c59598 changed no PR diff paths or crypto decisions):

  • cargo check --workspace --all-targets --locked: PASS.
  • cargo clippy --workspace --all-targets --locked -- -D warnings: PASS.
  • cargo test -p preloop-gha-protocol --locked crypto::tests -- --nocapture: PASS, 17 passed.
  • cargo test --workspace --no-fail-fast: PASS, 2822 passed, 3 ignored.
  • cargo fmt --all -- --check: PASS.
  • cargo vet --locked: BLOCKED by 9 unvetted dependencies (asn1-rs, asn1-rs-derive, bit-vec, der-parser, oid-registry, pem, rcgen, x509-parser, yasna, all on the selected rcgen/x509-parser graph). Main's already-landed exemptions are used; this PR does not modify policy files.
  • just conform / just dogfood: not run; this environment has no official-runner/live-runner gate. The open runner-validation review concern remains open and was not marked resolved.

Summary by CodeRabbit

  • Chores
    • Updated underlying cryptography and certificate-generation components. Encryption, certificate generation, and other user-facing behavior remain unchanged in this release. No new features or user-visible changes are included.