From 6827a5c02cdd92848d7e13f247db3e9e92b5677d Mon Sep 17 00:00:00 2001 From: autoantohaki Date: Wed, 21 Oct 2026 16:04:50 -0300 Subject: [PATCH 1/2] Fix Linux build: convert rustix errors and satisfy clippy The Unix-only model store used ? on rustix calls whose Errno had no conversion into the crate error, so cargo check failed on Linux and CI on main has been red since. Add the conversion, and take the credential open error by reference so the Unix branch of map_open_error passes clippy without an underscore-prefixed binding. --- crates/impossible-models/src/lib.rs | 7 +++++++ crates/impossible-server-core/src/security.rs | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/crates/impossible-models/src/lib.rs b/crates/impossible-models/src/lib.rs index 69b2f72..57ffbdb 100644 --- a/crates/impossible-models/src/lib.rs +++ b/crates/impossible-models/src/lib.rs @@ -151,6 +151,13 @@ impl From for Error { } } +#[cfg(unix)] +impl From for Error { + fn from(value: rustix::io::Errno) -> Self { + Self::Io(value.into()) + } +} + impl From for Error { fn from(value: reqwest::Error) -> Self { let kind = if value.is_connect() { diff --git a/crates/impossible-server-core/src/security.rs b/crates/impossible-server-core/src/security.rs index b25df83..c8ade72 100644 --- a/crates/impossible-server-core/src/security.rs +++ b/crates/impossible-server-core/src/security.rs @@ -109,7 +109,7 @@ fn open_secret_file(path: &Path) -> Result { let mut options = OpenOptions::new(); options.read(true); configure_no_follow(&mut options); - options.open(path).map_err(map_open_error) + options.open(path).map_err(|error| map_open_error(&error)) } #[cfg(unix)] @@ -136,9 +136,10 @@ fn configure_no_follow(options: &mut OpenOptions) { #[cfg(not(any(unix, windows)))] fn configure_no_follow(_options: &mut OpenOptions) {} -fn map_open_error(_error: std::io::Error) -> CredentialError { +#[cfg_attr(not(unix), allow(unused_variables))] +fn map_open_error(error: &std::io::Error) -> CredentialError { #[cfg(unix)] - if _error.raw_os_error() == Some(libc::ELOOP) { + if error.raw_os_error() == Some(libc::ELOOP) { return CredentialError::Invalid; } CredentialError::Unavailable From 17b7d3317070b38660b611bfdbdc6a90220a3417 Mon Sep 17 00:00:00 2001 From: autoantohaki Date: Wed, 21 Oct 2026 16:33:08 -0300 Subject: [PATCH 2/2] Update rustls and webpki crates for new security advisories cargo deny now fails on RUSTSEC-2026-0346, -0347, -0348, -0349 (rustls), -0382 (rustls-webpki) and -0381/-0383 (webpki-roots, webpki-root-certs). These crates back the TLS client used for model downloads. Bump them to the patched releases and regenerate the third-party notices. --- Cargo.lock | 16 ++++++++-------- THIRD_PARTY_LICENSES.txt | 8 ++++---- THIRD_PARTY_NOTICES.md | 8 ++++---- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6165fd3..d014000 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1926,9 +1926,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "once_cell", "ring", @@ -1950,9 +1950,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -2896,18 +2896,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/THIRD_PARTY_LICENSES.txt b/THIRD_PARTY_LICENSES.txt index e7b4cd0..d9ae219 100644 --- a/THIRD_PARTY_LICENSES.txt +++ b/THIRD_PARTY_LICENSES.txt @@ -1278,7 +1278,7 @@ TEXT: a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2 [crate] L TEXT: a6c48161a09acc75a0e25503bab66a731eb5fba5392ed4bb4743e4ba5085327a [crate] LICENSE-Apache-2.0_WITH_LLVM-exception TEXT: 23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3 [crate] LICENSE-MIT -PACKAGE: rustls 0.23.45 +PACKAGE: rustls 0.23.46 DECLARED-LICENSE: Apache-2.0 OR ISC OR MIT UPSTREAM: https://github.com/rustls/rustls TEXT: a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2 [crate] LICENSE-APACHE @@ -1291,7 +1291,7 @@ UPSTREAM: https://github.com/rustls/pki-types TEXT: 45fd05c4865e7c350b98ad7ac50e1b15462d49af4a91e9b0c9dd933dc9a69742 [crate] LICENSE-APACHE TEXT: 9117d922e667125508dde62b02c1f57ed22f5ad21eb536aa2e2d99e1c796e639 [crate] LICENSE-MIT -PACKAGE: rustls-webpki 0.103.15 +PACKAGE: rustls-webpki 0.103.16 DECLARED-LICENSE: ISC UPSTREAM: https://github.com/rustls/webpki TEXT: 5b698ca13897be3afdb7174256fa1574f8c6892b8bea1a66dd6469d3fe27885a [crate] LICENSE @@ -1907,12 +1907,12 @@ UPSTREAM: https://github.com/daxpedda/web-time TEXT: 54a744942eb3fa63a74d8d359989ed6962c04f3f10ff20cfa08ff8aa7efbe4e6 [crate] LICENSE-APACHE TEXT: f428305bbf2e70fbd807af0f3c7ac1b7acfb95311640f451e9d2e48db6d7e96b [crate] LICENSE-MIT -PACKAGE: webpki-root-certs 1.0.9 +PACKAGE: webpki-root-certs 1.0.10 DECLARED-LICENSE: CDLA-Permissive-2.0 UPSTREAM: https://github.com/rustls/webpki-roots TEXT: e271993808fec50ab29350b39539cdec611a9103f827e0aa26d61da70e2d33f8 [crate] LICENSE -PACKAGE: webpki-roots 1.0.9 +PACKAGE: webpki-roots 1.0.10 DECLARED-LICENSE: CDLA-Permissive-2.0 UPSTREAM: https://github.com/rustls/webpki-roots TEXT: e271993808fec50ab29350b39539cdec611a9103f827e0aa26d61da70e2d33f8 [crate] LICENSE diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 835736b..e9158d4 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -199,9 +199,9 @@ The inventory below records declared package licenses. The corresponding copyrig | `ring` | 0.17.14 | `Apache-2.0 AND ISC` | crates.io | | `rustc-hash` | 2.1.3 | `Apache-2.0 OR MIT` | crates.io | | `rustix` | 1.1.4 | `Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT` | crates.io | -| `rustls` | 0.23.45 | `Apache-2.0 OR ISC OR MIT` | crates.io | +| `rustls` | 0.23.46 | `Apache-2.0 OR ISC OR MIT` | crates.io | | `rustls-pki-types` | 1.15.1 | `MIT OR Apache-2.0` | crates.io | -| `rustls-webpki` | 0.103.15 | `ISC` | crates.io | +| `rustls-webpki` | 0.103.16 | `ISC` | crates.io | | `rustversion` | 1.0.23 | `MIT OR Apache-2.0` | crates.io | | `ryu` | 1.0.23 | `Apache-2.0 OR BSL-1.0` | crates.io | | `schannel` | 0.1.29 | `MIT` | crates.io | @@ -294,8 +294,8 @@ The inventory below records declared package licenses. The corresponding copyrig | `wasm-streams` | 0.4.2 | `MIT OR Apache-2.0` | crates.io | | `web-sys` | 0.3.105 | `MIT OR Apache-2.0` | crates.io | | `web-time` | 1.1.0 | `MIT OR Apache-2.0` | crates.io | -| `webpki-root-certs` | 1.0.9 | `CDLA-Permissive-2.0` | crates.io | -| `webpki-roots` | 1.0.9 | `CDLA-Permissive-2.0` | crates.io | +| `webpki-root-certs` | 1.0.10 | `CDLA-Permissive-2.0` | crates.io | +| `webpki-roots` | 1.0.10 | `CDLA-Permissive-2.0` | crates.io | | `winapi` | 0.3.9 | `MIT/Apache-2.0` | crates.io | | `winapi-i686-pc-windows-gnu` | 0.4.0 | `MIT/Apache-2.0` | crates.io | | `winapi-x86_64-pc-windows-gnu` | 0.4.0 | `MIT/Apache-2.0` | crates.io |