[polaz]

Summary

The rust_crypto backend kept rustls-rustcrypto 0.0.2-alpha and jsonwebtoken's own backend, which hold crypto-bigint 0.5 and rustls-webpki 0.102, carrying RUSTSEC-2026-0387 and RUSTSEC-2026-0382. Both give way to the TLS and JWT providers of sid-crypto, over current RustCrypto primitives; rustls keeps TLS and path validation, jsonwebtoken keeps parsing and claims.

The advisory exceptions those crates needed are removed; only RUSTSEC-2023-0071 remains, with its reason restated.

Behavior change: on this backend RSA is public-key only. A TLS listener presents a P-256, P-384 or Ed25519 key, and an RSA key is refused at startup. RSA servers are still verified as a client. aws_lc_rs or an installed provider serves an RSA certificate.

Testing

915 tests on the default build and 944 with all features pass, clippy with all features and cargo fmt pass, and cargo audit reports nothing against the local advisory database. The RSA client tests talk to a test server on ring, a dev-only dependency, since the provider under test cannot sign with RSA.

Closes #154

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T18:37:20.040768Z	f9c84e9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 91700f23-3868-4e83-9b29-7335107302e9

Commits

Reviewing files that changed from the base of the PR and between 7c5864c and f9c84e9.

Files selected for processing: 1

• src/tls/tests.rs

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 33dddad2-e35d-44cf-a0ef-629e866b0776

Commits

Reviewing files that changed from the base of the PR and between 8e3470b and 7c5864c.

Files selected for processing: 12

• .cargo/audit.toml
• Cargo.toml
• README.md
• deny.toml
• src/auth/crypto.rs
• src/auth/crypto/tests.rs
• src/serve/tests.rs
• src/shield/resolve/tests.rs
• src/tls.rs
• src/tls/tests.rs
• tests/shutdown.rs
• tests/tls.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• Security

  • RustCrypto JWT and TLS providers refuse RSA private keys. TLS configurations using RSA certificates can use AWS-LC or another installed provider instead.
  • Security audits now report advisories that were previously ignored, including advisories affecting rustls-webpki and paste.

• Documentation

  • Updated guidance explains RustCrypto provider behavior and available alternatives for TLS certificates.

The project switches its RustCrypto JWT and TLS provider integrations to sid-crypto. Provider-selection code, tests, dependency features, documentation, and security advisory exceptions are updated.

Changes: RustCrypto Provider Update

Layer / File(s)	Summary
Shared provider dependency and advisory setup Cargo.toml, .cargo/audit.toml, deny.toml	Cargo features and test dependencies now select sid-crypto. The audit configurations retain only RUSTSEC-2023-0071.
JWT provider selection src/auth/crypto.rs, src/auth/crypto/tests.rs, README.md	JWT provider selection and related tests use sid-crypto’s RustCrypto provider. The README states that this provider refuses RSA private keys.
TLS provider integration src/tls.rs, src/tls/tests.rs, src/serve/tests.rs, src/shield/resolve/tests.rs, tests/shutdown.rs, tests/tls.rs, README.md	TLS provider setup and tests use sid-crypto or ring. The README describes supported listener keys and provider alternatives.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: Minimal · previous review 7c586

The provider change has no identified merge-blocking risk and is ready to merge after normal checks.

Pre-merge checks: 3 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check		The diff replaces rustls-rustcrypto and jsonwebtoken RustCrypto selection with sid-crypto, updates the RustCrypto provider tests, and removes the obsolete advisory exceptions. src/tls.rs still g…	Provide reviewable evidence for the missing #154 criteria, or add focused tests and configuration checks that demonstrate RSA private-key refusal before parsing, the required TLS/mTLS and JWT cases, supported feature combinations, and exter…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: replacing the existing RustCrypto providers with maintained providers.
Description check		The description directly explains the provider replacement, RSA behavior change, removed advisory exceptions, testing, and linked issue.
Out of Scope Changes check		The changed files update the provider dependency, feature wiring, provider-selection tests, TLS test setup, documentation, and advisory configuration. These changes directly support #154 and its depen…

Full details: Out of Scope Changes check

Explanation

The changed files update the provider dependency, feature wiring, provider-selection tests, TLS test setup, documentation, and advisory configuration. These changes directly support #154 and its dependency and security requirements. No unrelated product behavior or unrelated files appear in the reviewed diff.

Full details: Docstring Coverage

Explanation

Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 8 files. (4 skipped: 4 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Full details: Linked Issues check

Explanation

The diff replaces rustls-rustcrypto and jsonwebtoken RustCrypto selection with sid-crypto, updates the RustCrypto provider tests, and removes the obsolete advisory exceptions. src/tls.rs still gives an installed provider precedence and builds client and mTLS server configurations with rustls. The available evidence does not establish all #154 acceptance criteria. In particular, the diff does not show tests for RSA listener-key refusal before key parsing, the full JWT algorithm and malformed-key matrix, or the external-backend and no-backend embedding configurations. The RSA refusal behavior is supplied by the external sid-crypto dependency, whose implementation was not available for inspection.

Resolution

Provide reviewable evidence for the missing #154 criteria, or add focused tests and configuration checks that demonstrate RSA private-key refusal before parsing, the required TLS/mTLS and JWT cases, supported feature combinations, and external-backend/no-backend embeddings.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High impact] No blocking issues were identified in the changes since the previous review.

Summary

Replaces the TLS and JWT providers for rust_crypto with sid-crypto and removes the old advisory exceptions. RSA verification remains supported, while RSA listener keys are refused at startup.

The changes since the previous review add the requested regression test. On a rust_crypto-only build, it passes the RSA fixtures to production server_config and asserts that startup fails with an error identifying the certificate file and unsupported private keys. This addresses the previous regression-coverage concern; polaz confirmed the addition in the thread.

No new actionable issues were found in the changes since the previous review.

• JWT and TLS use the RustCrypto providers from sid-crypto.
• TLS listeners reject RSA keys on the pure-Rust provider.

_{Reviews (2) · Last reviewed commit: "test(tls): refuse an RSA key on the pure..." · Reviewed by Greptile}