OSS/openmail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Drop mail-auth's 'generate' feature: removes RUSTSEC-2023-0071

Browse Source 
cargo-deny's advisory check caught the rsa crate (RUSTSEC-2023-0071, the
Marvin Attack — private-key recovery through a timing sidechannel that is
observable over the network, with no fixed version available).

Root cause was ours: enabling mail-auth's 'generate' feature, which exists
to create DKIM keypairs and pulls in the pure-Rust rsa implementation. The
default aws-lc-rs backend signs and verifies in constant time, which is what
a service listening on :25 actually needs. Key generation is a one-time
operator action and belongs in tooling (openssl genpkey), not in the daemon.

Fixed by removing the feature rather than by adding an advisory exception —
the reason is recorded inline in Cargo.toml so nobody re-adds it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7
This commit is contained in:
Karti Tripathi
2026-09-02 14:01:15 -07:00
co-authored by Claude Opus 5
parent c24f71518a
commit 4b6f08e170
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.toml
+8 -1
View File
@@ -44,7 +44,14 @@ openmail-mcp = { version = "0.1.0", path = "crates/openmail-mcp" }
# --- third party (all Apache-2.0 or MIT; see NOTICE) ---
mail-parser = { version = "0.11", features = ["full_encoding"] }
mail-builder = "0.5"
mail-auth = { version = "0.12", features = ["generate"] }
# NO "generate" feature. It pulls in the `rsa` crate, which carries
# RUSTSEC-2023-0071 (Marvin Attack — private-key recovery through a timing
# sidechannel observable over the network) with no fixed version available.
# The default `aws-lc-rs` backend signs and verifies in constant time, which is
# what a network service actually needs. DKIM keypair generation is a one-time
# operator action and belongs in tooling (`openssl genpkey`), not in a daemon
# listening on :25.
mail-auth = { version = "0.12" }
smtp-proto = "0.2"
hickory-resolver = { version = "0.26", features = ["dnssec-ring"] }