[sanity]

Problem

freenet/web was missed by the earlier eMudhra sweep. ghostkey-api is a member of the rust/ workspace, so it builds from rust/Cargo.lock (not rust/api/Cargo.lock, which cargo ignores). That lockfile has webpki-roots 0.26.3, which still contains the eMudhra emSign roots (emSign ECC Root CA - G3, - C3, emSign Root CA - C1) distrusted after the intermediate-key compromise disclosed 2026-10-17, and rustls-webpki 0.102.6. The API's rustls client is the reqwest used for the Tor exit-list fetch (rust/api/src/tor.rs); Stripe (async-stripe via hyper-tls) uses OpenSSL and the host trust store, so it is not affected by this lockfile.

Approach

Lockfile only, in rust/Cargo.lock: cargo update -p rustls -p webpki-roots, then rustls-webpki to 0.103.16 with the smallest set of supporting bumps, keeping every new crate version at least 7 days old (the repo's dependabot cooldown), except webpki-roots 1.0.11, which is the fix itself.

• webpki-roots 0.26.3 -> 0.26.11, which is a shim over 1.0.11 (drops the three emSign roots above; emSign Root CA - G1, which is not in the affected chains, stays).
• rustls 0.23.12 -> 0.23.46 and rustls-webpki 0.102.6 -> 0.103.16; 0.103.16 rejects certificate paths containing the distrusted intermediate keys. The rustls bump is required because rustls 0.23.12 pins the 0.102 line.
• aws-lc-rs 1.8.1 -> 1.18.2 and aws-lc-sys 0.20.1 -> 0.46.0 (the minimum rustls 0.23.46 accepts is aws-lc-rs 1.18), with cc 1.1.6 -> 1.2.60, cmake, dunce, rustls-pki-types and new find-msvc-tools following. pkg-config 0.3.30 -> 0.3.34 is required by the new aws-lc-sys, which also probes for a system AWS-LC at build time and falls back to building from source. It no longer needs bindgen, so bindgen and its dependencies drop out. shlex stays on 1.x.

rust/api/Cargo.lock is deleted. Cargo does not read it for workspace builds (rust/api is a member of rust/), but it still carried old rustls-webpki/webpki-roots versions, so lockfile scanners and audits flagged versions that never ship (an earlier audit of this exposure was misled by it). Dependabot discovers it through the /rust entry and opens PRs against it (e.g. #219), which have no effect on the build.

The deployed API picks this up only when it is rebuilt and redeployed from main.

Testing

cargo check -p ghostkey-api clean on this branch; existing CI (rust-api-tests.yml builds and tests ghostkey-api).

[AI-assisted - Claude]

https://claude.ai/code/session_01Xxpwzw71GZJYts7ENMXYX2

[sanity]

Review: four Claude lenses (code-first, skeptical/supply-chain, testing, big-picture) plus a re-review of the fix commit. Codex was tried first and failed with a usage-limit error, so a fourth Claude lens (testing) was substituted.

Findings addressed in fe5c462: aws-lc-rs/aws-lc-sys were under 24h old against the repo's 7-day cooldown (pinned to 1.18.2/0.46.0); shlex major bump avoided (cc 1.2.60); the stale, unused rust/api/Cargo.lock deleted; PR text corrected (Stripe uses OpenSSL via hyper-tls, not rustls; emSign Root CA - G1 stays in webpki-roots). All changed crate checksums verified against static.crates.io.

Remaining, not blocking: no test makes an outbound TLS connection through rustls (https_startup.rs covers the crypto-provider install only), so the Tor exit-list fetch will be checked by hand after deploy. After merge, Dependabot #219 and #200 only edit the deleted file and can be closed.

[AI-assisted - Claude]