Dependencies with unfixed advisories, MPL license, deprecated sodiumoxide, and OpenSSL #7

New issue

Closed

opened 2026-10-09 11:20:32 +00:00 by thesimplekid · 0 comments

thesimplekid commented

2026-10-09 11:20:32 +00:00

Owner

Summary

Run through a typical cargo deny policy (advisories plus a license allow-list without MPL-2.0), the dependency tree fails:

h2 0.3: unbounded empty DATA frames;
rustls-webpki 0.101: three advisories (URI name constraints, wildcard name constraints, CRL parsing panic);
rustls-pemfile: unmaintained;
webpki-roots 0.25: MPL-2.0;
sodiumoxide: deprecated (via macaroon 0.3).

Most of these come from ldk-server-client, which pins hyper 0.14, hyper-rustls 0.24, reqwest 0.11 and rustls 0.21. The rest come from satsettle's own reqwest 0.11. OpenSSL is used for SHA-256, HMAC and random bytes, which adds a native dependency.

Suggestion

Use ldk-server-grpc (types, framing) and ldk-server-macaroons (bind_macaroon_to_request), with a small client over reqwest 0.12 and rustls 0.23. LDK Server serves only HTTP/2 (h2 via ALPN), so the client must use http2_prior_knowledge() and reqwest's http2 feature. Without that, the TLS handshake fails. The calls needed are Bolt11Receive, Bolt11ReceiveForHash, Bolt11ClaimForId, Bolt11FailForId, GetPaymentDetails, ListPayments, and the server-streaming SubscribeEvents. Read the stream by buffering gRPC frames from response.chunk(), with HTTP/2 keep-alive pings instead of a request timeout. npub.cash does this in about 300 lines and checked it against LDK Server on regtest.
Encode and verify L402 V2 macaroons directly with hmac and sha2, instead of the macaroon crate.
Replace openssl with sha2, hmac, and getrandom or rand.
Move to reqwest 0.12 with rustls-tls everywhere.
Add a deny.toml and run cargo deny check in CI.

## Summary Run through a typical `cargo deny` policy (advisories plus a license allow-list without MPL-2.0), the dependency tree fails: - `h2 0.3`: unbounded empty DATA frames; - `rustls-webpki 0.101`: three advisories (URI name constraints, wildcard name constraints, CRL parsing panic); - `rustls-pemfile`: unmaintained; - `webpki-roots 0.25`: MPL-2.0; - `sodiumoxide`: deprecated (via `macaroon 0.3`). Most of these come from `ldk-server-client`, which pins `hyper 0.14`, `hyper-rustls 0.24`, `reqwest 0.11` and `rustls 0.21`. The rest come from satsettle's own `reqwest 0.11`. OpenSSL is used for SHA-256, HMAC and random bytes, which adds a native dependency. ## Suggestion - Use `ldk-server-grpc` (types, framing) and `ldk-server-macaroons` (`bind_macaroon_to_request`), with a small client over `reqwest 0.12` and `rustls 0.23`. LDK Server serves **only HTTP/2** (`h2` via ALPN), so the client must use `http2_prior_knowledge()` and reqwest's `http2` feature. Without that, the TLS handshake fails. The calls needed are `Bolt11Receive`, `Bolt11ReceiveForHash`, `Bolt11ClaimForId`, `Bolt11FailForId`, `GetPaymentDetails`, `ListPayments`, and the server-streaming `SubscribeEvents`. Read the stream by buffering gRPC frames from `response.chunk()`, with HTTP/2 keep-alive pings instead of a request timeout. npub.cash does this in about 300 lines and checked it against LDK Server on regtest. - Encode and verify L402 V2 macaroons directly with `hmac` and `sha2`, instead of the `macaroon` crate. - Replace `openssl` with `sha2`, `hmac`, and `getrandom` or `rand`. - Move to `reqwest 0.12` with `rustls-tls` everywhere. - Add a `deny.toml` and run `cargo deny check` in CI.

thesimplekid referenced this issue from a commit

2026-10-09 14:07:07 +00:00

fix: replace vulnerable Lightning transport and legacy crypto

thesimplekid referenced this issue from a pull request that will close it,

2026-10-09 14:08:17 +00:00

fix: replace vulnerable Lightning transport and legacy crypto #19

thesimplekid referenced this issue from a commit

2026-10-09 14:16:46 +00:00

fix: replace vulnerable Lightning transport and legacy crypto

thesimplekid referenced this issue from a commit

2026-10-09 14:18:32 +00:00

fix: replace vulnerable Lightning transport and legacy crypto