Move to elliptic-curve 0.14 and remove the cargo-audit exception for crypto-bigint 0.5.5 (RUSTSEC-2026-0387)

未关闭
  • 哪里不对？
#489 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
58/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
rust
领域
build-system, security, testing

调研方向

Start by reviewing elastos/.cargo/audit.toml, the cargo-audit CI job, all tracked Cargo.lock files, and the noted dependency chain through k256, p256, and hpke. Check how the CI job can enforce the advisory’s crate-version scope and re-review date, then run the affected signing, verification, and wallet tests. Done means all locks use the specified elliptic-curve versions, crypto-bigint 0.5.x and the advisory exception are gone, and the CI checks and tests pass.

由索引模型根据 Issue 内容生成。

描述

The cargo-audit exception for RUSTSEC-2026-0387 in elastos/.cargo/audit.toml covers crypto-bigint 0.5.5. elliptic-curve 0.13 (through k256 0.13, p256 0.13 and hpke 0.13) requires that version, and the crypto-bigint 0.5 line has no patched release. The exception comes with 454921cf0 for the 0.8.0 train (status in #93). Its entry says re-review by 2026-11-20.

Done means:

  • every tracked Cargo.lock uses elliptic-curve 0.14 or later, with k256 and p256 0.14 or later, and crypto-bigint 0.5.x leaves all locks;
  • the RUSTSEC-2026-0387 entry leaves elastos/.cargo/audit.toml;
  • the cargo-audit CI job fails when an ignored advisory matches a crate version other than the one its entry names, or when an entry passes its re-review date (cargo-audit ignores by advisory ID only, so today the scope and the date are comments);
  • the signing, verification and wallet tests of the changed crates pass on the new versions.
主要语言
Rust
星标
6
派生
2
平均合并
1 天 3 小时
30 天内合并 PR
42

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

elastos/elastos-runtime 的其他 Issue

查看 elastos/elastos-runtime 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。