Add Dependabot configuration and update Rust dependencies

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/rust"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build.yml

@@ -16,6 +16,9 @@ on:
       - 'rust/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -38,7 +41,7 @@ jobs:
             abi: x86
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -52,7 +55,7 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -109,7 +112,7 @@ jobs:
         env:
           TARGET: ${{ matrix.target }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: bin-${{ matrix.abi }}-${{ matrix.profile }}
           path: rust/target/${{ matrix.target }}/${{ matrix.profile }}/ta-enhanced
@@ -119,12 +122,12 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -214,13 +217,13 @@ jobs:
           mv release/*-debug.zip release/dbg/ 2>/dev/null || true
           mv release/*.zip release/rel/ 2>/dev/null || true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ta-enhanced-release-zip
           path: release/rel/*.zip
           retention-days: 30
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ta-enhanced-debug-zip
           path: release/dbg/*.zip
@@ -233,20 +236,20 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Read version
         id: ver
         run: |
           ver=$(grep '^version=' module.prop | cut -d= -f2)
           echo "version=${ver}" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ta-enhanced-release-zip
           path: zips/release
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ta-enhanced-debug-zip
           path: zips/debug

rust/Cargo.toml

@@ -6,19 +6,19 @@ edition = "2021"
 [dependencies]
 clap = { version = "= 4.5.57", features = ["derive"] }
 serde = { version = "= 1.0.228", features = ["derive"] }
-serde_json = "= 1.0.149"
+serde_json = "= 1.0.151"
 toml = "= 0.8.23"
 tracing = { version = "= 0.1.44", features = ["log"] }
 tracing-subscriber = { version = "= 0.3.22", features = ["env-filter"] }
 anyhow = "= 1.0.101"
 libc = "= 0.2.180"
 ureq = { version = "= 2.12.1", features = ["tls"] }
 quick-xml = { version = "= 0.37.2", features = ["serialize"] }
-base64 = "= 0.22.1"
-nix = { version = "= 0.29.0", features = ["signal", "process"] }
+base64 = "= 0.23.1"
+nix = { version = "= 0.31.1", features = ["signal", "process"] }
 ring = "0.17"
 x509-parser = "= 0.18.1"
-rcgen = { version = "0.12", default-features = false, features = ["pem", "ring"] }
+rcgen = { version = "0.14", default-features = false, features = ["pem", "ring"] }
 rsa = { version = "0.9", default-features = false, features = ["std", "pem"] }
 p256 = { version = "= 0.13.2", default-features = false, features = ["std", "pem", "pkcs8", "ecdsa"] }
 p384 = { version = "= 0.13.1", default-features = false, features = ["std", "pem", "pkcs8", "ecdsa"] }

rust/src/keybox/generate.rs

@@ -1,5 +1,5 @@
 use anyhow::{Context, Result};
-use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256};
+use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256};
 use rsa::RsaPrivateKey;
 use rsa::pkcs8::EncodePrivateKey;
 
@@ -33,15 +33,16 @@ pub fn generate_and_install() -> Result<()> {
 
 fn generate() -> Result<String> {
     let mut params = CertificateParams::default();
-    params.alg = &PKCS_ECDSA_P256_SHA256;
     params.distinguished_name = DistinguishedName::new();
     params.distinguished_name.push(DnType::CommonName, "Android Keybox");
 
-    let cert = Certificate::from_params(params)
+    let ec_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
+        .context("EC key generation failed")?;
+    let cert = params
+        .self_signed(&ec_key)
         .context("EC cert generation failed")?;
-    let ec_pem = cert.serialize_private_key_pem();
-    let cert_pem = cert.serialize_pem()
-        .context("cert serialization failed")?;
+    let ec_pem = ec_key.serialize_pem();
+    let cert_pem = cert.pem();
 
     let mut rng = rand::rngs::OsRng;
     let rsa_key = RsaPrivateKey::new(&mut rng, 2048)

rust/src/keybox/validate.rs

@@ -767,18 +767,18 @@ mod tests {
 
     #[test]
     fn ecdsa_p256_self_signed_link_verifies() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.distinguished_name = DistinguishedName::new();
         params
             .distinguished_name
             .push(DnType::CommonName, "test-leaf");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
 
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
         verify_link(&parsed, &parsed).expect("self-signed P-256 link verifies");
     }
 
@@ -811,18 +811,18 @@ mod tests {
 
     #[test]
     fn lookup_revocation_finds_serial() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256, SerialNumber};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256, SerialNumber};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.serial_number = Some(SerialNumber::from(0xdead_beefu64));
         params.distinguished_name = DistinguishedName::new();
         params
             .distinguished_name
             .push(DnType::CommonName, "rev-test");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
 
         let mut entries = serde_json::Map::new();
         entries.insert(
@@ -839,16 +839,16 @@ mod tests {
 
     #[test]
     fn lookup_revocation_returns_none_when_clean() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256, SerialNumber};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256, SerialNumber};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.serial_number = Some(SerialNumber::from(0x1234u64));
         params.distinguished_name = DistinguishedName::new();
         params.distinguished_name.push(DnType::CommonName, "clean");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
 
         let mut entries = serde_json::Map::new();
         entries.insert(

rust/src/platform/signal.rs

@@ -5,7 +5,7 @@ pub static SHUTDOWN: AtomicBool = AtomicBool::new(false);
 pub fn register_shutdown_handler() {
     unsafe {
         let mut sa: libc::sigaction = std::mem::zeroed();
-        sa.sa_sigaction = shutdown_handler as usize;
+        sa.sa_sigaction = shutdown_handler as *const () as usize;
         sa.sa_flags = libc::SA_RESTART;
         libc::sigaction(libc::SIGTERM, &sa, std::ptr::null_mut());
         libc::sigaction(libc::SIGINT, &sa, std::ptr::null_mut());