Drop mail-auth's 'generate' feature: removes RUSTSEC-2023-0071

cargo-deny's advisory check caught the rsa crate (RUSTSEC-2023-0071, the
Marvin Attack — private-key recovery through a timing sidechannel that is
observable over the network, with no fixed version available).

Root cause was ours: enabling mail-auth's 'generate' feature, which exists
to create DKIM keypairs and pulls in the pure-Rust rsa implementation. The
default aws-lc-rs backend signs and verifies in constant time, which is what
a service listening on :25 actually needs. Key generation is a one-time
operator action and belongs in tooling (openssl genpkey), not in the daemon.

Fixed by removing the feature rather than by adding an advisory exception —
the reason is recorded inline in Cargo.toml so nobody re-adds it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7

This commit is contained in:

Karti Tripathi

2026-09-02 14:01:15 -07:00

co-authored by

Claude Opus 5

parent c24f71518a

commit 4b6f08e170

2 changed files with 8 additions and 3 deletions

Cargo.lock

Generated

-2

View File

@@ -1364,8 +1364,6 @@ dependencies = [
  "mail-builder 0.4.4",
  "mail-parser",
  "quick-xml",
  "rand 0.8.8",
  "rsa",
  "rustls-pki-types",
  "serde",
  "serde_json",