Skip to content

Upgrade der to 0.8 #7695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 2 commits into from
Apr 27, 2026
Merged

Upgrade der to 0.8 #7695

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f95f2f
Update `der` to 0.8, move to workspace dependencies
ShaharNaveh Apr 27, 2026
646b526
Add `pem` feature
ShaharNaveh Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 24 additions & 7 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ ruff_source_file = { package = "rustpython-ruff_source_file", version = "0.15.8"
# ruff_text_size = { git = "https://github.com/astral-sh/ruff.git", rev = "c2a8815842f9dc5d24ec19385eae0f1a7188b0d9" }
# ruff_source_file = { git = "https://github.com/astral-sh/ruff.git", rev = "c2a8815842f9dc5d24ec19385eae0f1a7188b0d9" }

der = { version = "0.8", features = ["alloc", "oid", "pem", "zeroize"] }

@coderabbitai coderabbitai Bot Apr 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Enumerate every `der::` usage and the modules that mix der with pkcs8 / x509-cert / x509-parser,
# to assess whether the duplicate der 0.7 / 0.8 in the dep graph causes type-incompatibility issues.

echo "=== Direct uses of the `der` crate ==="
rg -nP --type=rust -C2 '\b(use\s+der(::|;)|\bder::)' || true

echo
echo "=== Files that import both der and pkcs8 / x509-cert / x509-parser ==="
fd -e rs -x sh -c '
  f="$1"
  if rg -q "^\s*use\s+der(::|;)|\bder::" "$f" \
     && rg -q "^\s*use\s+(pkcs8|x509_cert|x509_parser)(::|;)|\b(pkcs8|x509_cert|x509_parser)::" "$f"; then
    echo "MIXED: $f"
  fi
' _ {}

echo
echo "=== der versions actually resolved ==="
rg -nP '^name = "der"|^version = "0\.(7|8)' Cargo.lock | sed -n '1,200p'

echo
echo "=== pkcs8 / x509-cert / x509-parser versions resolved (which der do they pull?) ==="
rg -nP -A6 '^\[\[package\]\]\s*\nname = "(pkcs8|x509-cert|x509-parser|oid-registry)"' Cargo.lock || true

Repository: RustPython/RustPython

Length of output: 1785

🌐 Web query:

What is the minimum version of pkcs8 and x509-cert that supports der 0.8?

💡 Result:

The minimum versions of the RustCrypto pkcs8 and x509-cert crates that support der 0.8 are their respective 0.11.0-rc and 0.3.0-rc pre-release versions. For pkcs8: versions prior to 0.11.0 (e.g., 0.10.2) depend on der ^0.7, while 0.11.0-rc.8 and later specify der ^0.8.0-rc.9 in their dependencies, indicating compatibility with der 0.8.0. For x509-cert: versions prior to 0.3.0 (e.g., 0.2.5) depend on der ^0.7.6, while 0.3.0-rc.0 and later (latest 0.3.0-rc.4) specify der ^0.8.0-rc.3, confirming support for der 0.8.0. These crates are part of the RustCrypto/formats monorepo, where der 0.8.0 was released on 2026-02-13, and dependent crates were updated in parallel via pre-releases to match.

Citations:

🏁 Script executed:

# Check if we can access files directly or list the repository structure
find . -name "Cargo.toml" -type f 2>/dev/null | head -20

Repository: RustPython/RustPython

Length of output: 625

🏁 Script executed:

# Search for der and pkcs8/x509-cert version specifications in Cargo files
find . -name "Cargo.toml" -type f 2>/dev/null | xargs grep -l "der\|pkcs8\|x509-cert" 2>/dev/null | head -10

Repository: RustPython/RustPython

Length of output: 291

🌐 Web query:

pkcs8 0.10.2 der dependency version

💡 Result:

The pkcs8 crate version 0.10.2 depends on the der crate with version requirement ^0.7 (i.e., >=0.7.0, <0.8.0). It also specifies 1 extra feature for der.

Citations:

🌐 Web query:

x509-cert 0.2.5 der dependency version

💡 Result:

The x509-cert crate version 0.2.5 depends on the der crate at version ^0.7.6 (specifically version = "0.7.6" with features = ["alloc", "derive", "flagset", "oid"]). This is confirmed directly from the official Cargo.toml source code for x509-cert 0.2.5.

Citations:

🏁 Script executed:

# Read Cargo.toml around line 173 to see the der version
sed -n '165,180p' ./Cargo.toml

Repository: RustPython/RustPython

Length of output: 1202

🏁 Script executed:

# Read crates/stdlib/Cargo.toml to check pkcs8 and x509-cert versions
cat ./crates/stdlib/Cargo.toml | grep -A2 -B2 "pkcs8\|x509-cert"

Repository: RustPython/RustPython

Length of output: 1077

🏁 Script executed:

# Check if der is used and what features are gated by ssl-rustls
grep -n "ssl-rustls" ./Cargo.toml

Repository: RustPython/RustPython

Length of output: 206

🏁 Script executed:

# Search for der usage patterns in the codebase to understand the scope
rg -l "use der|der::" --type rust | head -20

Repository: RustPython/RustPython

Length of output: 619

🌐 Web query:

pkcs8 0.11.0 stable release der 0.8

💡 Result:

The pkcs8 Rust crate from RustCrypto does not have a stable 0.11.0 release as of 2026-04-27. The latest version is the pre-release 0.11.0-rc.11, released on 2026-02-11. The previous stable version is 0.10.2. This 0.11.0 release candidate depends on der ^0.8.0-rc.12 (as shown in Cargo.toml for rc.11), aligning with the query's mention of der 0.8. No stable 0.11.0 or exact der 0.8 (stable) match was found; der 0.8 appears in pre-releases.

Citations:

🌐 Web query:

x509-cert 0.3.0 stable release der 0.8

💡 Result:

The RustCrypto x509-cert crate does not have a stable 0.3.0 release as of 2026-04-27. The latest version is 0.3.0-rc.4 (released 2026-01-25). Pre-releases like 0.3.0-pre.0 exist from 2024-10-08, and a v0.3 release train was tracked in GitHub issue #1289 (closed Oct 2024). This version depends on der ^0.8.0-rc.3 (and later RCs use der ^0.8.0-rc.10), aligning with der 0.8 development. The prior stable v0.2.5 uses der ^0.7.6. No full stable 0.3.0 is published on crates.io.

Citations:

🏁 Script executed:

# Check if ssl-rustls feature is tested or used in CI
rg -l "ssl-rustls" --type=yaml --type=toml | head -10

Repository: RustPython/RustPython

Length of output: 101

🏁 Script executed:

# Check if there are any type conflicts or mixing of der 0.7 and 0.8 in the stdlib crate
grep -n "use der" crates/stdlib/src/*.rs 2>/dev/null | head -20

Repository: RustPython/RustPython

Length of output: 47

Version incompatibility: der 0.8 is incompatible with pkcs8 0.10 and x509-cert 0.2.5 currently pinned in crates/stdlib/Cargo.toml.

The workspace now specifies der = "0.8" while crates/stdlib/Cargo.toml still depends on pkcs8 = "0.10" and x509-cert = "0.2.5", which both require der ^0.7. This creates a dual-version dependency graph with both der 0.7 and der 0.8 present. Since both packages are only pulled in via the ssl-rustls feature, the risk is contained to that feature flag—as long as no der-typed values (e.g., AnyRef, ObjectIdentifier) cross the version boundary between the two, compilation will succeed. However, any such crossing will produce cryptic type mismatch errors.

Verify this builds with --features ssl-rustls before merging. If build succeeds, consider upgrading pkcs8 and x509-cert to versions compatible with der 0.8. Currently, only pre-release versions support this (e.g., pkcs8 = "0.11.0-rc" and x509-cert = "0.3.0-rc"); stable releases matching der 0.8 have not yet been published.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Cargo.toml` at line 173, The workspace now pins der = { version = "0.8",
features = [...] } while crates/stdlib still depends on pkcs8 = "0.10" and
x509-cert = "0.2.5" which require der ^0.7; fix by reconciling these dependency
versions: either roll back the workspace der to 0.7 to match pkcs8/x509-cert, or
upgrade pkcs8 and x509-cert to versions compatible with der 0.8 (e.g., pkcs8 =
"0.11.0-rc" and x509-cert = "0.3.0-rc"), then rebuild and verify the project
compiles with --features ssl-rustls to ensure no dual der versions remain.

phf = { version = "0.13.1", default-features = false, features = ["macros"]}
ahash = "0.8.12"
ascii = "1.1"
Expand Down
2 changes: 1 addition & 1 deletion crates/stdlib/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ rustls-pemfile = { version = "2.2", optional = true }
rustls-platform-verifier = { version = "0.7", optional = true }
x509-cert = { version = "0.2.5", features = ["pem", "builder"], optional = true }
x509-parser = { version = "0.18", optional = true }
der = { version = "0.7", features = ["alloc", "oid"], optional = true }
der = { workspace = true, optional = true }
pem-rfc7468 = { version = "1.0", features = ["alloc"], optional = true }
webpki-roots = { version = "1.0", optional = true }
aws-lc-rs = { version = "1.16.3", optional = true }
Expand Down
Loading