Cargo.toml

@@ -18,7 +18,7 @@ opt-level = 3
 [dependencies]
 async-trait = "0.1.77"
 axum = "0.7.4"
-base64 = "0.22.0"
+base64 = "0.21.7"
 clap = { version = "4.5.0", features = ["derive"] }
 color-eyre = { version = "0.6.2" }
 hex = { version = "0.4.3", features = ["serde"] }
@@ -26,11 +26,11 @@ hmac = "0.12.1"
 ldap3 = { version = "0.11.3", default-features = false, features = ["tls-rustls"] }
 md-5 = "0.10.6"
 rand = "0.8.5"
-reqwest = { version = "0.12.0", features = ["json"] }
+reqwest = { version = "0.11.24", features = ["json"] }
-secrecy = { version = "0.10.0", features = ["serde"] }
+secrecy = { version = "0.8.0", features = ["serde"] }
 serde = { version = "1.0.196", features = ["derive"] }
 sha2 = "0.10.8"
-sqlx = { version = "0.8.0", features = ["runtime-tokio", "tls-rustls", "sqlite", "time"] }
+sqlx = { version = "0.7.3", features = ["runtime-tokio", "tls-rustls", "sqlite", "time"] }
 thiserror = "1.0.56"
 time = { version = "0.3.34", features = ["formatting", "macros"] }
 tokio = { version = "1.36.0", features = ["macros", "rt-multi-thread"] }
@@ -39,3 +39,10 @@ tracing = "0.1.40"
 tracing-error = "0.2.0"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
 url = { version = "2.5.0", features = ["serde"] }
+
+# latest versions with ring 0.16
+rustls = "=0.21.7"
+rustls-webpki = "=0.101.6"
+sct = "=0.7.0"
+# end of overrides
+

deny.toml

@@ -1,12 +1,7 @@
 [licenses]
+copyleft = "allow"
+allow-osi-fsf-free = "both"
 allow = [
-	"MIT",
-	"Apache-2.0",
-	"MPL-2.0",
-	"ISC",
-	"BSD-3-Clause",
-	"BSD-2-Clause",
-	"AGPL-3.0",
 	"OpenSSL",
 	"Unicode-DFS-2016",
 ]

src/secrets.rs

@@ -2,7 +2,7 @@ use std::fmt::Debug;
 
 use hex::FromHex;
 use rand::{thread_rng, Rng};
-use secrecy::{ExposeSecret, SecretSlice, SecretString};
+use secrecy::{ExposeSecret, SecretString, SecretVec};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
@@ -10,7 +10,7 @@ use thiserror::Error;
 pub struct Password(pub SecretString);
 impl From<String> for Password {
     fn from(value: String) -> Self {
-        Self(value.into())
+        Self(SecretString::new(value))
     }
 }
 
@@ -24,7 +24,7 @@ impl PartialEq for Password {
 pub struct UserToken(pub SecretString);
 impl From<String> for UserToken {
     fn from(value: String) -> Self {
-        Self(value.into())
+        Self(SecretString::new(value))
     }
 }
 
@@ -38,7 +38,7 @@ impl PartialEq for UserToken {
 pub struct UserServerKey(pub SecretString);
 impl From<String> for UserServerKey {
     fn from(value: String) -> Self {
-        Self(value.into())
+        Self(SecretString::new(value))
     }
 }
 
@@ -46,7 +46,7 @@ impl From<String> for UserServerKey {
 pub struct ServerPadlock(pub SecretString);
 impl From<String> for ServerPadlock {
     fn from(value: String) -> Self {
-        Self(value.into())
+        Self(SecretString::new(value))
     }
 }
 
@@ -54,8 +54,7 @@ impl From<String> for ServerPadlock {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServerHash(pub String);
 
-#[derive(Debug, Clone)]
+pub struct PadlockGenerationSecret(pub SecretVec<u8>);
-pub struct PadlockGenerationSecret(pub SecretSlice<u8>);
 
 impl PadlockGenerationSecret {
     /// Entirely arbitrary
@@ -67,6 +66,19 @@ impl PadlockGenerationSecret {
     }
 }
 
+impl Debug for PadlockGenerationSecret {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_tuple("PadlockGenerationSecret")
+            .field(&"[REDACTED Vec<u8>]")
+            .finish()
+    }
+}
+impl Clone for PadlockGenerationSecret {
+    fn clone(&self) -> Self {
+        PadlockGenerationSecret(self.0.expose_secret().clone().into())
+    }
+}
+
 #[derive(Debug, Clone, Error)]
 #[error(
     "Padlock secret too short, must be at least {} bytes - here's a fresh secret for you: {}",