fix(deps): patch h2, rustls and anyhow advisories

.github/workflows/gateway.yml

@@ -19,6 +19,16 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
+      - uses: EmbarkStudios/cargo-deny-action@v2
+
   test:
     runs-on: ubuntu-latest
     services:
@@ -50,7 +60,7 @@ jobs:
 
   image:
     runs-on: ubuntu-latest
-    needs: test
+    needs: [lint, test]
     if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v5

Cargo.toml

@@ -11,8 +11,7 @@ pedantic = "deny"
 tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "signal", "time"] }
 rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs", "std", "tls12"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["aws-lc-rs", "tls12"] }
-rustls-pemfile = "2"
-rustls-pki-types = "1"
+rustls-pki-types = { version = "1.12", features = ["std"] }
 x509-parser = { version = "0.18", default-features = false }
 hyper = { version = "1", features = ["server", "http2"] }
 hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }

deny.toml

@@ -0,0 +1,37 @@
+# cargo-deny configuration: https://embarkstudios.github.io/cargo-deny/
+[graph]
+all-features = true
+
+[advisories]
+# Vulnerabilities, unsound and unmaintained crates all fail the check. To accept one
+# temporarily, add { id = "RUSTSEC-...", reason = "..." } here.
+unmaintained = "all"
+yanked = "deny"
+ignore = []
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+]
+confidence-threshold = 0.93
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

src/tls.rs

@@ -1,5 +1,3 @@
-use std::fs::File;
-use std::io::BufReader;
 use std::path::Path;
 use std::sync::Arc;
 
@@ -10,6 +8,7 @@ use rustls::{
     CertificateError, DigitallySignedStruct, DistinguishedName, Error as RustlsError, ServerConfig,
     SignatureScheme,
 };
+use rustls_pki_types::pem::{self, PemObject};
 use rustls_pki_types::{CertificateDer, PrivateKeyDer, UnixTime};
 pub use tokio_rustls::TlsAcceptor;
 use x509_parser::prelude::*;
@@ -119,16 +118,16 @@ fn parse_certificate(cert: &CertificateDer<'_>) -> Result<(), RustlsError> {
 }
 
 fn load_cert_chain(path: &Path) -> anyhow::Result<Vec<CertificateDer<'static>>> {
-    let file = File::open(path)?;
-    let mut reader = BufReader::new(file);
-    let certs = rustls_pemfile::certs(&mut reader).collect::<Result<Vec<_>, _>>()?;
+    let certs = CertificateDer::pem_file_iter(path)
+        .with_context(|| format!("opening {}", path.display()))?
+        .collect::<Result<Vec<_>, _>>()?;
     ensure!(!certs.is_empty(), "no certificates in {}", path.display());
     Ok(certs)
 }
 
 fn load_private_key(path: &Path) -> anyhow::Result<PrivateKeyDer<'static>> {
-    let file = File::open(path)?;
-    let mut reader = BufReader::new(file);
-    rustls_pemfile::private_key(&mut reader)?
-        .ok_or_else(|| anyhow!("no private key in {}", path.display()))
+    match PrivateKeyDer::from_pem_file(path) {
+        Err(pem::Error::NoItemsFound) => Err(anyhow!("no private key in {}", path.display())),
+        res => res.with_context(|| format!("reading private key {}", path.display())),
+    }
 }