[storopoli]

Description

Fixes the three RustSec advisories from the emSign intermediate distrust that cargo audit reports on main:

Crate	Change	Advisory
rustls-webpki	0.103.15 → 0.103.16	RUSTSEC-2026-0382
webpki-roots	1.0.9 → 1.0.10	RUSTSEC-2026-0381
webpki-root-certs	1.0.5 → 1.0.10	RUSTSEC-2026-0383

There are two commits: one for rustls-webpki, and one for both root-store crates.

The private keys for several emSign intermediates are now public. rustls-webpki before 0.103.16 can accept certificate paths that contain those intermediates' public keys when the configured trust anchors allow such paths. 0.103.16 rejects those paths.

webpki-roots and webpki-root-certs before 1.0.10 bundle emSign ECC Root CA - G3, which lets those paths reach a trusted anchor. 1.0.10 removes that root. The webpki-roots and webpki-root-certs 0.26.11 compatibility crates in the lockfile hold no roots of their own; they re-export their 1.x dependency, which now resolves to 1.0.10.

The lockfile changes touch only each crate's version and checksum, plus the dependency entries that name those versions.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature/Enhancement (non-breaking change which adds functionality or enhances an existing one)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor
• New or updated tests
• Dependency Update

Notes to Reviewers

Reachability. rustls-webpki and webpki-roots are compiled into every node build. They verify server certificates for our outbound TLS clients (bitreq through bitcoind-async-client, reqwest, hyper-rustls, and the jsonrpsee HTTP and WS clients). The clients that trust webpki-roots trusted the emSign root until this bump. webpki-root-certs is a normal dependency of rustls-platform-verifier only on wasm32, so it does not compile into our node builds. It is still recorded in Cargo.lock, which is what cargo audit scans.

Cooldown override. All three releases came out on 2026-10-19 or 2026-10-20, inside the 14-day cooldown, so the resolves used the override documented in .cargo/config.toml:

CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p rustls-webpki --precise 0.103.16
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p webpki-roots@1.0.9 --precise 1.0.10
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p webpki-root-certs@1.0.5 --precise 1.0.10

The rustls-webpki update also moved tempfile's getrandom edge from 0.3.4 to 0.4.2. tempfile accepts >=0.3.0, <0.5 and both versions were already locked. The change was unrelated, so I reverted it.

The SP1 checkpoint guest lockfile (provers/sp1/guest-checkpoint/Cargo.lock) contains none of these crates.

Is this PR addressing any specification, design doc or external reference document?

• Yes
• No

If yes, please add relevant links:

• https://rustsec.org/advisories/RUSTSEC-2026-0382 (0.103.16: reject cert paths containing distrusted SPKIs rustls/webpki#546)
• https://rustsec.org/advisories/RUSTSEC-2026-0381, -0383 (webpki-roots|webpki-root-certs: Prepare 1.0.10, remove emSign root rustls/webpki-roots#133)
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Checklist

• I have performed a self-review of my code.
• I have commented my code where necessary.
• I have updated the documentation if needed.
• My changes do not introduce new warnings.
• I have added (where necessary) tests that prove my changes are effective or that my feature works.
• New and existing tests pass with my changes.
• I have disclosed my use of AI in the body of this PR.

Local checks: cargo metadata --locked resolves and cargo check --locked -p strata builds against the bumped crates. cargo audit, unit tests, and functional tests are left to CI.

AI assistance: Claude Code ran the cargo update commands, reverted the unrelated tempfile edge, traced the dependency paths, and drafted this PR description.

Related Issues

Fixes RUSTSEC-2026-0381, RUSTSEC-2026-0382, and RUSTSEC-2026-0383.

[github-actions]

🔒 AI Security Review (claude-opus-5-5)

✅ No security issues found.

[github-actions]

🔒 AI Security Review (claude-opus-5-5)

✅ No security issues found.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T15:10:43.548272Z	def762e	PR opened
🔒 Security Review	🔄 Running since 2026-10-21T15:08:59.615231Z	def762e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Commit: 9374d8a
Baseline: #2408 (508f3c3)
SP1 Execution Results

program	cycles	gas	Δ cycles	Δ gas
Checkpoint	2,782,155	3,212,830	0 (0.0%)	0 (0.0%)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.21%. Comparing base (508f3c3) to head (def762e).

@@            Coverage Diff             @@
##             main    #2410      +/-   ##
==========================================
- Coverage   89.21%   89.21%   -0.01%     
==========================================
  Files         440      440              
  Lines       75934    75934              
==========================================
- Hits        67747    67744       -3     
- Misses       8187     8190       +3     

Flag	Coverage Δ
functional	58.71% <ø> (ø)
unit	81.98% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[storopoli]

Force-merging this because we need this asap cc @alexhui01