deislabs / bindle

Bindle: Object Storage for Collections
Apache License 2.0
263 stars 37 forks source link

build: update `ed25519-dalek` and `base64` #368

Closed rvolosatovs closed 1 year ago

rvolosatovs commented 1 year ago

This addresses a security vulnerability

rvolosatovs commented 1 year ago

@microsoft-github-policy-service agree company="Cosmonic"

bacongobbler commented 1 year ago

Hi @rvolosatovs. It appears the build is failing. Can you please fix up the PR so that the project compiles?

Here are the list of failures from CI:

error[E0432]: unresolved imports `ed25519_dalek::Keypair`, `ed25519_dalek::PublicKey`
 --> src/invoice/signature.rs:3:25
  |
3 | pub use ed25519_dalek::{Keypair, PublicKey, Signature as EdSignature, Signer};
  |                         ^^^^^^^  ^^^^^^^^^ no `PublicKey` in the root
  |                         |
  |                         no `Keypair` in the root
  |
  = help: consider importing this variant instead:
          openid::biscuit::jws::Secret::PublicKey

error[E0432]: unresolved import `ed25519_dalek::PublicKey`
 --> src/invoice/verification.rs:5:21
  |
5 | use ed25519_dalek::{PublicKey, Signature as EdSignature};
  |                     ^^^^^^^^^ no `PublicKey` in the root
  |
  = help: consider importing one of these items instead:
          crate::signature::PublicKey
          openid::biscuit::jws::Secret::PublicKey

warning: unused import: `Signer`
  --> src/invoice/mod.rs:40:47
   |
40 | use ed25519_dalek::{Signature as EdSignature, Signer};
   |                                               ^^^^^^
   |
   = note: `#[warn(unused_imports)]` on by default

For more information about this error, try `rustc --explain E0432`.
warning: `bindle` (lib) generated 1 warning
error: could not compile `bindle` (lib) due to 2 previous errors; 1 warning emitted
make: *** [Makefile:75: build-server] Error 101
Error: Process completed with exit code 2.

Thanks!

rvolosatovs commented 1 year ago

@bacongobbler this is now ready for review, PTAL

thomastaylor312 commented 1 year ago

Looks like there are some other vulns that cargo deny is finding. I'm ok ignoring for this PR and doing as a follow up before we cut a patch release