apache / apache/teaclave-sgx-sdk

rustls & webpki dependencies are messed up in mesalock

Open
#206 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.2k
Forks
268
PR merge metrics
No merged PRs in 30d

Description

There are inconsistencies between referencing crates with `branch=mesalock_sgx` and tag=`sgx_v1.1.0`

i.e. this here causes trouble:
https://github.com/mesalock-linux/rustls/blob/d9a91f5037f5c85f761279d97b838256285a1314/Cargo.toml#L19

rustls `tag sgx_v1.1.0` depends on webpki `branch=mesaloch_sgx` but I'd expect it to depend on `tag sgx_v1.1.0`

In [our Cargo.toml](https://github.com/scs/substraTEE-worker/blob/dd9c6051c4145262bb0beae9da7a8538fcf793d9/enclave/Cargo.toml#L54) we now have a mess between branch and tag dependencies leading to this (after a cargo update):

```
error: failed to select a version for the requirement `webpki-roots = "^0.17.0"`
candidate versions found which didn't match: 0.19.0
location searched: Git repository https://github.com/mesalock-linux/webpki-roots?branch=mesalock_sgx
required by package `substratee_worker_enclave v4.0.0 (/home/abrenzikofer/substraTEE-worker/enclave)`
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked rustls Cargo.toml at the referenced commit and enclave/Cargo.toml in substraTEE-worker, then reproduce the dependency resolution failure with cargo update. Trace the mesalock_sgx branch and sgx_v1.1.0 tag references across rustls, webpki, and webpki-roots; done means the dependency graph resolves consistently without the reported webpki-roots version error.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.