dependency updates for pre-hash signing

most of them are just shifting existing dependencies around but
somehow we're also now depending on pem-rfc7468. This slipped in
because we now use a `der` method to interpret a pkcs-8 query.

You know, this is kind of silly in the end because in practice,
the key file is like literally 64 bytes and we're pulling in net about
four orders of magnitude more code to make sure we parse those
64 bytes in exactly the right way -- because we have the *whole*
spec pulled in as crates even though we only ever use a tiny section
of it.

otoh, just vendoring in code or hard-coding an offset in a key file
seems "broken". But maybe that's a false economy because I can
point to the one sin I commit in doing a trivial interpretation
of the key file (e.g. hard-coding an offset with some minimal
format checking), whereas probably in the tens of thousands
of lines of code pulled in to interpret the pkcs-8 format "correctly"
which I actually didn't review explicitly, there are many more
sins, but because I've externalized them into crates I can say
I can sleep well at night thinking I did the right thing by
avoiding that one sin. It's like buying index funds and yet not
feeling remorse about the actions of the corporations within
the fund because you didn't explicitly endorse their actions but
you still get to participate in their gains.

Somehow, this has turned into a commentary on the human condition.
This commit is contained in:
bunnie 2024-01-05 16:20:43 +08:00
parent c51c3cfe79
commit b247a5cc0e

16
Cargo.lock generated
View file

@ -1350,6 +1350,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6919815d73839e7ad218de758883aae3a257ba6759ce7a9992501efbb53d705c"
dependencies = [
"const-oid",
"pem-rfc7468",
]
[[package]]
@ -1543,6 +1544,7 @@ dependencies = [
"curve25519-dalek",
"ed25519",
"rand 0.7.3",
"serde",
"sha2 0.9.8",
"zeroize",
]
@ -2712,6 +2714,7 @@ dependencies = [
"curve25519-dalek-loader",
"ed25519-dalek-loader",
"lazy_static",
"sha2-loader",
"utralib",
]
@ -3393,6 +3396,15 @@ dependencies = [
"regex",
]
[[package]]
name = "pem-rfc7468"
version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "01de5d978f34aa4b2296576379fcc416034702fd94117c56ffd8a1a767cefb30"
dependencies = [
"base64ct",
]
[[package]]
name = "percent-encoding"
version = "2.3.0"
@ -5015,14 +5027,18 @@ dependencies = [
name = "tools"
version = "0.1.0"
dependencies = [
"base64 0.20.0",
"bitflags 1.3.2",
"clap 2.34.0",
"crc",
"csv",
"ed25519-dalek",
"env_logger 0.7.1",
"log",
"pem",
"pkcs8",
"ring",
"sha2 0.9.8",
"svd2utra",
"xmas-elf",
"xous-semver",