From 41d13c750a27e596ded32f74cc86b014bfc5c075 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 2 Aug 2026 11:14:47 +0800 Subject: [PATCH] fix(deps): widen ewf 0.2 -> 0.4, caret-trapped below the maintained line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `ewf = { version = "0.2", optional = true }` cannot reach 0.4.x. `cargo update` will not cross a caret, so the pin has sat at 0.2.3 while the crate moved to 0.4.7 (published 2026-07-25) — the layer-1 freshness trap, invisible to both `cargo update` and Renovate's default rangeStrategy. `ewf` is not a spare wheel here. `forensic-image` is a DEFAULT feature and it gates `dep:ewf`, so every stock build ships this code path: src/forensic_image/ewf_backend.rs:2 use ewf::EwfReader; src/forensic_image/mod.rs:261 ImageFormat::Ewf => ewf_backend::verify_ewf(path) 0.2 -> 0.4 crosses two 0.x minors, which are breaking by convention, so this was checked rather than assumed. The surface actually consumed is `EwfReader::open`, `total_size`, `stored_hashes`, `metadata`, and `verify` plus the fields of what those return. All of it still compiles, and — the part that matters — still produces the same answers on a real image: test tests::verify_ewf_image_passes ... ok test tests::verify_ewf_image_returns_stored_hashes ... ok test tests::verify_ewf_image_returns_metadata ... ok test tests::detect_ewf_format ... ok test tests::cli_verify_image_e01 ... ok test result: ok. 19 passed; 0 failed; 0 ignored Those are not compile-only. `tests/data/nps-2010-emails.E01` is a real 518,680-byte EWF image from the NPS corpus; the test decompresses it, computes MD5 and SHA-1 over the media, and compares against the hashes the original 2010 acquisition tool stored inside the file. The expected values were authored by a third party, not by us, so a silent behavioural regression in 0.4's reader or verifier would surface as a mismatch rather than a passing tautology. The dependency graph gets smaller, not larger. One in, five out: ADDED : ewf 0.4.7 REMOVED: ewf 0.2.3, instant 0.1.13, parking_lot 0.11.2, parking_lot_core 0.8.6, redox_syscall 0.2.16, socket2 0.5.10 Worth correcting one thing about the unpushed commit 41e1090, which does the same widening and was used only as a starting point to verify: its lock diff shows `adler2` being ADDED to ewf's dependencies. That is not true against a re-synced lock — `adler2` is already present from the earlier adler->adler2 migration, so the real delta is a net removal of five packages. `[[trusted.ewf]]` already covers 0.4.7: the trust is bound to the publisher and a date window, not to a version, and 0.4.7 was published inside it. cargo-vet refreshed the `imports.lock` publisher record from 0.2.3 to 0.4.7 by itself. Vetting Succeeded (169 fully audited, 5 partially audited, 624 exempted) Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 102 ++++++++++---------------------------- Cargo.toml | 2 +- supply-chain/imports.lock | 4 +- 3 files changed, 28 insertions(+), 80 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 48dac86..764507d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -125,7 +125,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -136,7 +136,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -1591,7 +1591,7 @@ dependencies = [ "bitflags 2.11.0", "crossterm_winapi", "mio 1.2.0", - "parking_lot 0.12.5", + "parking_lot", "rustix 0.38.44", "signal-hook", "signal-hook-mio", @@ -1943,7 +1943,7 @@ checksum = "6e39034cee21a2f5bbb66ba0e3689819c4bb5d00382a282006e802a7ffa6c41d" dependencies = [ "cfg-if", "libc", - "socket2 0.6.3", + "socket2", "windows-sys 0.60.2", ] @@ -2107,7 +2107,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -2144,10 +2144,11 @@ dependencies = [ [[package]] name = "ewf" -version = "0.2.3" +version = "0.4.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2fde641ed13ecc3cbefd1db2133530f4d7ac681bdd4a60aee0563279fca97fb" +checksum = "f9f0aae36d49a5b16a1353b4b80f7d0090666ca19dd910aed7b0ab1d35bf8f60" dependencies = [ + "adler2", "flate2", "glob", "log", @@ -2417,7 +2418,7 @@ checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f" dependencies = [ "futures-core", "lock_api", - "parking_lot 0.12.5", + "parking_lot", ] [[package]] @@ -2835,7 +2836,7 @@ dependencies = [ "rand 0.9.3", "regex", "roxmltree 0.21.1", - "socket2 0.6.3", + "socket2", "thiserror 2.0.18", "tokio", "url", @@ -3021,7 +3022,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.5.10", + "socket2", "tokio", "tower-service", "tracing", @@ -3282,15 +3283,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "instant" -version = "0.1.13" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222" -dependencies = [ - "cfg-if", -] - [[package]] name = "intaglio" version = "1.13.3" @@ -3361,7 +3353,7 @@ dependencies = [ "portable-atomic", "portable-atomic-util", "serde_core", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -4049,7 +4041,7 @@ dependencies = [ "equivalent", "event-listener", "futures-util", - "parking_lot 0.12.5", + "parking_lot", "portable-atomic", "smallvec", "tagptr", @@ -4509,17 +4501,6 @@ version = "2.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba" -[[package]] -name = "parking_lot" -version = "0.11.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99" -dependencies = [ - "instant", - "lock_api", - "parking_lot_core 0.8.6", -] - [[package]] name = "parking_lot" version = "0.12.5" @@ -4527,21 +4508,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" dependencies = [ "lock_api", - "parking_lot_core 0.9.12", -] - -[[package]] -name = "parking_lot_core" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc" -dependencies = [ - "cfg-if", - "instant", - "libc", - "redox_syscall 0.2.16", - "smallvec", - "winapi", + "parking_lot_core", ] [[package]] @@ -5028,7 +4995,7 @@ dependencies = [ "quinn-udp", "rustc-hash 2.1.2", "rustls 0.23.37", - "socket2 0.5.10", + "socket2", "thiserror 2.0.18", "tokio", "tracing", @@ -5065,7 +5032,7 @@ dependencies = [ "cfg_aliases 0.2.1", "libc", "once_cell", - "socket2 0.5.10", + "socket2", "tracing", "windows-sys 0.60.2", ] @@ -5215,15 +5182,6 @@ dependencies = [ "crossbeam-utils", ] -[[package]] -name = "redox_syscall" -version = "0.2.16" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a" -dependencies = [ - "bitflags 1.3.2", -] - [[package]] name = "redox_syscall" version = "0.5.18" @@ -5560,7 +5518,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -6012,16 +5970,6 @@ version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b" -[[package]] -name = "socket2" -version = "0.5.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678" -dependencies = [ - "libc", - "windows-sys 0.52.0", -] - [[package]] name = "socket2" version = "0.6.3" @@ -6029,7 +5977,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -6292,7 +6240,7 @@ dependencies = [ "bitflags 2.11.0", "libc", "libssh2-sys", - "parking_lot 0.12.5", + "parking_lot", ] [[package]] @@ -6500,7 +6448,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix 1.1.4", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -6671,7 +6619,7 @@ dependencies = [ "libc", "mio 1.2.0", "pin-project-lite", - "socket2 0.6.3", + "socket2", "tokio-macros", "windows-sys 0.61.2", ] @@ -7538,7 +7486,7 @@ dependencies = [ "js-sys", "log", "naga", - "parking_lot 0.11.2", + "parking_lot", "profiling", "raw-window-handle", "smallvec", @@ -7566,7 +7514,7 @@ dependencies = [ "log", "naga", "once_cell", - "parking_lot 0.11.2", + "parking_lot", "profiling", "raw-window-handle", "rustc-hash 1.1.0", @@ -7607,7 +7555,7 @@ dependencies = [ "ndk-sys", "objc", "once_cell", - "parking_lot 0.11.2", + "parking_lot", "profiling", "range-alloc", "raw-window-handle", @@ -7692,7 +7640,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 1d86507..62937dd 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -109,7 +109,7 @@ ed25519-dalek = { version = "2", features = ["rand_core"] } rand = "0.8" argon2 = "0.5" rpassword = "6" -ewf = { version = "0.2", optional = true } +ewf = { version = "0.4", optional = true } wgpu = { version = "22", optional = true } pollster = { version = "0.3", optional = true } toml = "0.8" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index b0853be..73802e7 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -111,8 +111,8 @@ user-login = "Mytherin" user-name = "Mark" [[publisher.ewf]] -version = "0.2.3" -when = "2026-06-26" +version = "0.4.7" +when = "2026-07-25" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui"