Summary
This update for sequoia-sq fixes the following issues:
Changes in sequoia-sq:
- Use crypto-openssl also for tests
Update to version 1.5.0:
* tool: Release v1.5.0.
* tool: Fix link to README.
* tool: Set a version for the sqz dependency.
* Enable optimizations when building rust-crypto crates.
* Update NEWS.
* lib: Release v0.1.0.
* Update Cargo.lock.
* meta: Update link to documentation.
* lib: Update README.
* lib: Rename the high-level library to sqz.
* lib: Fix documentation.
* lib: Mention network_search in the lookup functions documentation.
* lib: Mention lookup and lookup_by in the certify documentation.
* lib: Mention lookup_by sign documentation.
* lib: Document that calls don't need to specify secret key material.
* lib: Fix docs.rs URL
* meta: Add rustfmt.toml that disables formatting
* lib: fix type infer error
* lib: Pass Paths through as is.
* lib: Preprocess the network when listing all bindings.
* lib: Upgrade sequoia-wot.
* lib: After running cert list, save the signature verification cache.
* lib: Parallelize cert list.
* lib: Pass the policy when getting the trust root or a shadow CA.
* implement dumping of pqc artifacts
* lib: Use an iterator instead of a slice.
* lib: Avoid monomorphization in signer.
* lib: Fix documentation.
* tool: Fix documentation.
* lib: Drop unnecessary imports in example.
* lib: Add required clap features.
* lib: Gate network support behind a feature.
* Don't conflate inline and cleartext signatures.
* lib: Document the signer module.
* lib: Add unit tests to the signer module.
* lib: Fix get_primary_keys's return type.
* lib: Convert get_signing_key, etc. to use the builder pattern.
* lib: Move decrypt_key to its own module.
* lib: Rename keys module to signer.
* lib: Refactor get_keys and associated functions.
* lib: Improve prompt's documentation.
* lib: Add a default prompt to Sequoia, don't require a prompt.
* lib: Loosen Sized constraint.
* lib: Make Prompt and PromptFactory Send and Sync.
* lib: Change SequoiaBuilder::builder to consume self.
* lib: Use explicit lifetimes with Context and Check.
* Use more precise lifetimes when referencing Sequoia and Sq.
* Replace generic lifetime names with more precise identifiers.
* tool: Fix password prompt.
* lib: Add PromptFactory.
* tool: Drop Sq::local_trust_root.
* lib: Change Ca to wrap a Cert instead of an Arc<LazyCert>.
* lib: Add functionality for looking up certificates by email address.
* lib: Add cert::CertProblem::ParseError.
* tool: Don't wrap Sequoia::lookup.
* lib: Improve lookup's documentation.
* lib: Rename lookup to lookup_all.
* lib: Don't write lints to stderr.
* lib: Change lookup to use its own error type.
* lib: Fix how Binding::cert looks up a certificate.
* lib: Add an option to lookup certificates by subkey.
* lib: Rename lookup's keyflags parameter to key_capabilities.
* lib: Drop lookup's unused or_by_primary parameter.
* lib: Fix key flags matching bug in Sequoia::lookup.
* tool: Improve displaying possibly revoked certificates.
* lib: Change lookup to take a single key handle.
* lib: Improve key generate's documentation.
* lib: Add unit tests for key generate.
* lib: Avoid monomorphization in key generate.
* lib: Rename Artifact to Outcome.
* lib: Use impl IntoIterator in setters.
* lib: Drop duplicated code.
* lib: Implement Clone for a few data structures.
* lib: Mark UserIDLint as non-exhaustive.
* lib: Implement Clone for UserIDLint.
* lib: Implement IntoIterator for network::search::Query.
* lib: Change network search to return an Outcome on success.
* lib: Change function to take an IntoIterator instead of a Vec.
* lib: Avoid monomorphization in the network search functionality.
* lib: Implement Clone for a few data structures.
* lib: Make Response and SourceInfo clonable.
* lib: Change cert list to always emit a Report.
* lib: Change cert list to return an Outcome on success.
* lib: Change cert list's getters to use iterators.
* lib: Implement Clone for additional structs and enums.
* lib: Change the decrypt functions to return an Outcome on success.
* lib: Avoid monomorphization in the decrypt functionality.
* lib: Change decrypt's getters to use iterators.
* lib: Implement Clone for additional structs and enums.
* lib: Change KeyStoreUnreachable to use a more precise error type.
* lib: Add some additional unit tests for the verify functionality.
* lib: Change the verify functions to return an Outcome on success.
* lib: Change verify to avoid monomorphization.
* lib: Improve key import's documentation.
* lib: Make a parse error an operational error.
* lib: Implement Clone for additional structs and enums.
* lib: Respect SEQUOIA_HOME by default.
* lib: Add import_cert to import a single certificate.
* lib: Improve cert list's documentation.
* lib: Make a parse error an operational error.
* lib: Fix import to emit errors.
* lib: Fix cert::import::Builder::import to return an Outcome.
* lib: Change cert import's getters and setters to use iterators.
* lib: Implement Clone for a few data structures.
* lib: Fix Sequoia::trust_roots's cache.
* lib: Improve certify's documentation.
* lib: Rework certify's error handling.
* lib: Add SystemError to pki::certify::{Error,Output}.
* lib: Adjust certify::Error::CertificationError.
* lib: Refactor how certify populates Outcome.
* lib: Use impl IntoIterator in setters.
* lib: Improve encrypt's documentation.
* lib: Add some unit tests for the encrypt functionality.
* lib: Align encrypt's signing error with sign's signing error.
* lib: Drop encrypt::output::EncryptionFailed.
* lib: Change encrypt to return an Outcome on success.
* lib: Rename Encrypted to Report.
* lib: Change the encrypt functionality to emit errors.
* lib: Change encrypt to use its own error type.
* lib: Implement
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| openSUSE · Leap 16.0 | sequoia-sq | 1.5.0-bp160.1.1 |
Vulnerabilities 4
-
High 7.5
rustls-webpki before 0.103.13 Panic via empty BIT STRING
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no…
-
Medium 4.4
rustls-webpki before 0.103.10 CRL Revocation Check Bypass
rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a comprom…
-
Low 2.2
rustls webpki Name Constraints URI Validation Bypass
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are…
-
Low 2.2
rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.…