rustls 0.23.43 accepted TLS 1.3 handshake messages sent at the wrong
encryption level when they followed a key-changing message in the same
record, where RFC 8446 requires the connection to be terminated. The
transcript is still authenticated, so a handshake cannot be altered, but
a peer could send in plaintext what should be encrypted. It reaches the
agent through tonic -> tokio-rustls, on its mTLS gRPC link to ingest.
Fixed in 0.23.45, inside the existing range, so only the lockfile moves.
The advisory was published after main last passed, so the agent's
cargo-deny advisories job failed on every open PR, including ones that
never touched Rust.
Also drops the RUSTSEC-2025-0134 ignore from agent/deny.toml. Its own
reason said to delete it once tonic stopped pulling in rustls-pemfile;
tonic 0.14 no longer does, and cargo-deny warned the advisory was not
encountered.
Signed-off-by: John Coffey <[email protected]>
The last failing job in the security scan, and one that only became
visible once fail-fast stopped cancelling it.
Same class as the instant advisory handled in search/deny.toml:
unmaintained, not vulnerable. rustls-pemfile's repository was archived
in August 2025; there is no CVE, and the advisory itself says "No safe
upgrade is available". It arrives via cairnobs-agent -> tonic 0.12.3 ->
rustls-pemfile 2.2.0, so the migration to rustls-pki-types' PemObject
API is tonic's to make, not ours. The final rustls-pemfile release is a
thin wrapper over that same rustls-pki-types code, so the archived crate
is not running different logic from its replacement.
Recorded with a note to delete the entry at the next tonic upgrade
rather than let it ossify.
Full rebrand across cosmetic branding, code identifiers, and
infrastructure/data-plane naming, using the supplied Cairn OBS logo
package. Cosmetic: favicon/logo swap (also closes a stale license-audit
finding -- the old favicon was SvelteKit's unreplaced scaffold logo),
new centered welcome landing page, larger/legible sidebar logo, page
titles, CLAUDE.md/README/docs prose.
Code identifiers: Go module path github.com/sentry/sentry ->
github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc
regenerated); Rust crates sentry-agent/sentry-parser/sentry-search ->
cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully
renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type,
env vars); every session/auth cookie name; agent config paths and
Windows service identity.
Deliberately preserved: the gRPC wire protocol's protobuf packages
(sentry.logs.v1, sentry.agent.v1) and their Go import directory
(proto/sentry/...) -- renaming the wire-level package would break every
currently-deployed agent binary (confirmed two real hosts, including
mail.inbuxa.com, are actively streaming through this exact contract)
until rebuilt and redeployed in lockstep with an ingest cutover. Only
the Go module path wrapping the generated code changes.
Infrastructure: every docker-compose container name (root and three
component-level compose files); the Helm chart (directory, Chart.yaml,
named-template helpers, all templates, values.yaml image repos);
Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML
files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd
package. Caught and fixed real path-coupling bugs along the way: the
Helm chart's search/ingest volume mounts and the dev-only-credential
detection constant vs. docker-compose.yml's literal values had to move
together or a security warning would have silently stopped firing.
Data plane: Postgres database sentry_metadata -> cairnobs_metadata and
role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka
topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups.
Source-level defaults, docker-compose.yml, and every migrate.sh/
provision script default updated together; already-applied migration
files left untouched per this repo's immutable-migration convention.
Verified at every layer: all 13 Go modules build/vet/test clean, both
Rust workspaces (agent, search) build/clippy/test clean, npm run check/
build clean, docker compose config validates on all four compose files.
Live-verified against a real docker stack multiple times through this
work, including a final fresh-volume run confirming the actual renamed
Postgres database/role, ClickHouse database, and Kafka topic all work
end to end with a real login and query, zero console errors.
Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.
See /docs/compliance/ for the full report, inventory, and policy.
jcoffey-dev