[storopoli]

Description

Backports the root-store half of #2410 to releases/0.3.0:

Crate	Change	Advisory
webpki-roots	1.0.5 → 1.0.10	RUSTSEC-2026-0381
webpki-root-certs	1.0.5 → 1.0.10	RUSTSEC-2026-0383

1.0.10 of both crates removes emSign ECC Root CA - G3, the root that lets certificate paths through the distrusted emSign intermediates verify.

The other half of #2410, rustls-webpki 0.103.16 for RUSTSEC-2026-0382, can't be backported as a lockfile change. On this branch, reth-mdbx-sys from reth v1.9.1 pins cc = "=1.2.15". Every rustls-webpki release from 0.103.10 on needs aws-lc-rs ^1.14, which brings in aws-lc-sys 0.31 or later and its cc ^1.2.26 build dependency. Cargo can't lock two semver-compatible cc versions, so the resolve fails. The same pin blocks rustls 0.23.40+ and bitreq 0.3.5+. reth relaxed the pin to cc = "1.2.15" in v1.10.0; every v1.9.x tag keeps =1.2.15.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature/Enhancement (non-breaking change which adds functionality or enhances an existing one)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor
• New or updated tests
• Dependency Update

Notes to Reviewers

Root store changes. This skips 1.0.6 through 1.0.9, so it also brings in the Mozilla root store updates from those releases. The 1.0.9 → 1.0.10 step only removes emSign ECC Root CA - G3. Across 1.0.5 → 1.0.10, TLS_SERVER_ROOTS goes from 135 to 120 roots. 20 are removed, among them DigiCert Global Root CA, DigiCert High Assurance EV Root CA, DigiCert Assured ID Root CA, COMODO Certification Authority, GTS Root R2, and the three Trustwave Global roots. 5 are added: SECOM TLS ECC/RSA Root CA 2024, Telia EC/RSA TLS Root CA v3, and e-Szigno TLS Root CA 2023. main already runs with the 1.0.9 set. A client that trusts webpki-roots will stop accepting a server whose only chain ends at one of the removed roots.

Reachability. webpki-roots 1.0.x compiles into node and EE builds through hyper-rustls 0.27 and reqwest 0.12: the jsonrpsee HTTP client, alloy providers, strata-btcio, the OTLP exporter, and reth. webpki-root-certs is a dependency of rustls-platform-verifier 0.5.3 only on wasm32 (through the 0.26.11 shim), so it isn't compiled into our builds. It is still in Cargo.lock, which is what cargo audit scans.

Still affected after this PR. cargo audit still reports:

• RUSTSEC-2026-0382 for rustls-webpki 0.103.4 (rustls 0.23) and 0.101.7 (rustls 0.21)
• RUSTSEC-2026-0381 for webpki-roots 0.25.4

rustls-webpki 0.101.7 and webpki-roots 0.25.4 come from rustls 0.21 via two crates. One is bitreq 0.3.4, the bitcoind-async-client RPC transport built into the node, which uses TLS only for an https bitcoind URL. The other is reqwest 0.11 via esplora-client 0.11 and bdk_esplora 0.20, in alpen-cli. Neither the 0.101 line nor the 0.25 line has a fixed release. Getting off them needs bitreq 0.3.5+, which the cc pin blocks, and bdk_esplora 0.21+, which needs bdk_core 0.5 and so a bdk_wallet major upgrade.

The cargo-audit check doesn't scan this branch. security.yml on releases/0.3.0 runs cargo audit --file audit.toml. That makes cargo-audit read audit.toml as the lockfile, so it logs Scanning audit.toml for vulnerabilities (0 crate dependencies) and passes (see the cargo-audit job on #2374). main fixed this in #2245. The audit numbers here come from a local run of cargo-audit 0.22.2 against the advisory DB as of 2026-10-22: 38 vulnerabilities before and 36 after. The two cleared are RUSTSEC-2026-0381 for webpki-roots 1.0.5 and RUSTSEC-2026-0383. Nothing new appears.

Lockfile. Resolved with:

cargo update -p webpki-roots@1.0.5 --precise 1.0.10
cargo update -p webpki-root-certs@1.0.5 --precise 1.0.10

The resolve also moved data-encoding-macro-internal's syn edge from 2.0.117 to 1.0.109. It accepts >=1, <3 and both versions were already locked. That change is unrelated, so I reverted it, and cargo metadata --locked accepts the result. This branch has no .cargo/config.toml publish-age cooldown, so no override was needed. The SP1 guest lockfiles (guest-checkpoint, guest-alpen-acct, guest-alpen-chunk) contain none of these crates.

Is this PR addressing any specification, design doc or external reference document?

• Yes
• No

If yes, please add relevant links:

• https://rustsec.org/advisories/RUSTSEC-2026-0381, -0383 (webpki-roots|webpki-root-certs: Prepare 1.0.10, remove emSign root rustls/webpki-roots#133)
• https://rustsec.org/advisories/RUSTSEC-2026-0382 (0.103.16: reject cert paths containing distrusted SPKIs rustls/webpki#546), not fixed here
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Checklist

• I have performed a self-review of my code.
• I have commented my code where necessary.
• I have updated the documentation if needed.
• My changes do not introduce new warnings.
• I have added (where necessary) tests that prove my changes are effective or that my feature works.
• New and existing tests pass with my changes.
• I have disclosed my use of AI in the body of this PR.

Local checks: cargo metadata --locked resolves, and cargo check --locked -p strata-btcio builds reqwest 0.12 and hyper-rustls 0.27 against webpki-roots 1.0.10. Unit and functional tests are left to CI.

AI assistance: Claude Code ran the cargo update commands, reverted the unrelated syn edge, traced the cc pin and the dependency paths, ran the local cargo audit, compared the root sets, and drafted this PR description.

Related Issues

Backport of #2410. Fixes RUSTSEC-2026-0381 (webpki-roots 1.x) and RUSTSEC-2026-0383 on releases/0.3.0. RUSTSEC-2026-0382 stays open on this branch.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T19:14:50.999576Z	0a9f747	PR opened
🔒 Security Review	✅ Completed 2026-10-22T19:16:44.001807Z	0a9f747	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Commit: 1682090

SP1 Execution Results

program	cycles	gas
EVM EE Chunk	824,182	969,345
EVM EE Account	404,138	498,540
Checkpoint	2,662,675	3,081,075

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.23%. Comparing base (82f409a) to head (0a9f747).
⚠️ Report is 90 commits behind head on releases/0.3.0.

@@                Coverage Diff                 @@
##           releases/0.3.0    #2413      +/-   ##
==================================================
+ Coverage           85.25%   86.23%   +0.97%     
==================================================
  Files                 649      665      +16     
  Lines               80713    89356    +8643     
==================================================
+ Hits                68814    77058    +8244     
- Misses              11899    12298     +399     

Flag	Coverage Δ
functional	65.59% <ø> (-1.14%)	⬇️
unit	73.80% <ø> (+2.66%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 226 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.