diff --git a/dstack/Cargo.lock b/dstack/Cargo.lock index 4dee9115c..7bde72fa0 100644 --- a/dstack/Cargo.lock +++ b/dstack/Cargo.lock @@ -27,18 +27,6 @@ dependencies = [ "generic-array", ] -[[package]] -name = "aes" -version = "0.7.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e8b47f52ea9bae42228d07ec09eb676433d7c4ed1ebdf0f1d1c29ed446f1ab8" -dependencies = [ - "cfg-if", - "cipher 0.3.0", - "cpufeatures 0.2.17", - "opaque-debug", -] - [[package]] name = "aes" version = "0.8.4" @@ -46,7 +34,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" dependencies = [ "cfg-if", - "cipher 0.4.4", + "cipher", "cpufeatures 0.2.17", ] @@ -57,8 +45,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" dependencies = [ "aead", - "aes 0.8.4", - "cipher 0.4.4", + "aes", + "cipher", "ctr", "ghash", "subtle", @@ -185,12 +173,6 @@ version = "0.3.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb" -[[package]] -name = "arrayvec" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b" - [[package]] name = "arrayvec" version = "0.7.6" @@ -589,18 +571,7 @@ version = "0.10.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe" dependencies = [ - "digest 0.10.7", -] - -[[package]] -name = "blake2b_simd" -version = "0.5.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "afa748e348ad3be8263be728124b24a24f268266f6f5d58af9d75f6a40b5c587" -dependencies = [ - "arrayref", - "arrayvec 0.5.2", - "constant_time_eq 0.1.5", + "digest", ] [[package]] @@ -610,22 +581,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce" dependencies = [ "arrayref", - "arrayvec 0.7.6", + "arrayvec", "cc", "cfg-if", - "constant_time_eq 0.4.2", + "constant_time_eq", "cpufeatures 0.3.0", ] -[[package]] -name = "block-buffer" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4" -dependencies = [ - "generic-array", -] - [[package]] name = "block-buffer" version = "0.10.4" @@ -642,7 +604,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7" dependencies = [ "byteorder", - "cipher 0.4.4", + "cipher", ] [[package]] @@ -824,7 +786,7 @@ name = "cc-eventlog" version = "0.6.1" dependencies = [ "anyhow", - "digest 0.10.7", + "digest", "dstack-types", "ez-hash", "fs-err", @@ -836,7 +798,7 @@ dependencies = [ "serde-human-bytes", "serde_jcs", "serde_json", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -978,15 +940,6 @@ dependencies = [ "half 2.7.1", ] -[[package]] -name = "cipher" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ee52072ec15386f770805afd189a01c8841be8696bed250fa2f13c4c0d6dfb7" -dependencies = [ - "generic-array", -] - [[package]] name = "cipher" version = "0.4.4" @@ -1133,12 +1086,6 @@ dependencies = [ "unicode-xid", ] -[[package]] -name = "constant_time_eq" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc" - [[package]] name = "constant_time_eq" version = "0.4.2" @@ -1281,31 +1228,6 @@ version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" -[[package]] -name = "crossterm" -version = "0.19.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c36c10130df424b2f3552fcc2ddcd9b28a27b1e54b358b45874f88d1ca6888c" -dependencies = [ - "bitflags 1.3.2", - "crossterm_winapi", - "lazy_static", - "libc", - "mio 0.7.14", - "parking_lot 0.11.2", - "signal-hook 0.1.17", - "winapi", -] - -[[package]] -name = "crossterm_winapi" -version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0da8964ace4d3e4a044fd027919b2237000b24315a37c916f61809f1ff2140b9" -dependencies = [ - "winapi", -] - [[package]] name = "crunchy" version = "0.2.4" @@ -1335,16 +1257,6 @@ dependencies = [ "typenum", ] -[[package]] -name = "crypto-mac" -version = "0.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "25fab6889090c8133f3deb8f73ba3c65a7f456f66436fc012a1b1e272b1e103e" -dependencies = [ - "generic-array", - "subtle", -] - [[package]] name = "ct_monitor" version = "0.6.1" @@ -1358,7 +1270,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tokio", "tracing", "tracing-subscriber", @@ -1371,7 +1283,7 @@ version = "0.9.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835" dependencies = [ - "cipher 0.4.4", + "cipher", ] [[package]] @@ -1383,7 +1295,7 @@ dependencies = [ "cfg-if", "cpufeatures 0.2.17", "curve25519-dalek-derive", - "digest 0.10.7", + "digest", "fiat-crypto", "rustc_version", "subtle", @@ -1481,7 +1393,7 @@ dependencies = [ "hashbrown 0.14.5", "lock_api", "once_cell", - "parking_lot_core 0.9.12", + "parking_lot_core", ] [[package]] @@ -1519,7 +1431,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "signature", "tracing", "urlencoding", @@ -1540,7 +1452,7 @@ dependencies = [ "ring", "rsa", "rustls-pki-types", - "sha2 0.10.9", + "sha2", "signature", "untrusted 0.9.0", ] @@ -1702,22 +1614,13 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "digest" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066" -dependencies = [ - "generic-array", -] - [[package]] name = "digest" version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ - "block-buffer 0.10.4", + "block-buffer", "const-oid", "crypto-common", "subtle", @@ -1827,7 +1730,7 @@ dependencies = [ "base64 0.22.1", "bcrypt", "rocket", - "sha2 0.10.9", + "sha2", "subtle", ] @@ -1848,7 +1751,7 @@ dependencies = [ "futures", "hex", "hex_fmt", - "hmac 0.12.1", + "hmac", "insta", "nsm-attest", "nsm-qvl", @@ -1866,7 +1769,7 @@ dependencies = [ "serde_json", "sev-snp-attest", "sev-snp-qvl", - "sha2 0.10.9", + "sha2", "sha3", "tdx-attest", "tempfile", @@ -1982,7 +1885,7 @@ dependencies = [ "serde", "serde-duration", "serde_json", - "sha2 0.10.9", + "sha2", "shared_child", "smallvec", "socket2 0.5.10", @@ -2055,7 +1958,7 @@ dependencies = [ "sd-notify", "serde", "serde_json", - "sha2 0.10.9", + "sha2", "sha3", "strip-ansi-escapes", "sysinfo", @@ -2080,7 +1983,7 @@ dependencies = [ "prpc-build", "serde", "serde_json", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -2139,7 +2042,7 @@ dependencies = [ "serde-duration", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "sha3", "tempfile", "tokio", @@ -2184,7 +2087,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tar", "thiserror 2.0.18", ] @@ -2236,7 +2139,7 @@ dependencies = [ "reqwest", "serde", "serde_json", - "sha2 0.10.9", + "sha2", "tempfile", "tokio", "tracing", @@ -2271,7 +2174,7 @@ dependencies = [ "serde_cbor", "serde_json", "sev-snp-qvl", - "sha2 0.10.9", + "sha2", "tempfile", "tokio", "tpm-qvl", @@ -2294,7 +2197,7 @@ dependencies = [ "serde_jcs", "serde_json", "serde_with", - "sha2 0.10.9", + "sha2", "sha3", "size-parser", ] @@ -2329,7 +2232,6 @@ dependencies = [ "k256", "libc", "lspci", - "luks2", "nvattest", "nvml-wrapper", "parity-scale-codec", @@ -2345,7 +2247,8 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "serde_with", + "sha2", "sha3", "sodiumbox", "tdx-attest", @@ -2389,7 +2292,7 @@ dependencies = [ "serde-human-bytes", "serde_json", "sev-snp-qvl", - "sha2 0.10.9", + "sha2", "tar", "tempfile", "tokio", @@ -2446,7 +2349,7 @@ dependencies = [ "serde-human-bytes", "serde_ini", "serde_json", - "sha2 0.10.9", + "sha2", "shared_child", "size-parser", "strip-ansi-escapes", @@ -2489,7 +2392,7 @@ dependencies = [ "gpt", "hex", "serde_json", - "sha2 0.10.9", + "sha2", "tempfile", "tokio", "tracing", @@ -2509,7 +2412,7 @@ dependencies = [ "reqwest", "serde", "serde_json", - "sha2 0.10.9", + "sha2", "tempfile", "tokio", ] @@ -2533,7 +2436,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" dependencies = [ "der", - "digest 0.10.7", + "digest", "elliptic-curve", "rfc6979", "signature", @@ -2560,7 +2463,7 @@ dependencies = [ "ed25519", "rand_core 0.6.4", "serde", - "sha2 0.10.9", + "sha2", "subtle", "zeroize", ] @@ -2579,7 +2482,7 @@ checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" dependencies = [ "base16ct", "crypto-bigint", - "digest 0.10.7", + "digest", "ff", "generic-array", "group", @@ -2713,10 +2616,10 @@ checksum = "42b3b3adc5fbbc9e21416d5b721b1bccb501a87d7b32ac89f2c7cea229d40772" dependencies = [ "blake2", "blake3", - "digest 0.10.7", + "digest", "md-5", "sha1", - "sha2 0.10.9", + "sha2", "sha3", ] @@ -3387,7 +3290,7 @@ dependencies = [ "moka", "ndk-context", "once_cell", - "parking_lot 0.12.5", + "parking_lot", "rand 0.10.1", "resolv-conf", "smallvec", @@ -3403,17 +3306,7 @@ version = "0.12.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" dependencies = [ - "hmac 0.12.1", -] - -[[package]] -name = "hmac" -version = "0.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b" -dependencies = [ - "crypto-mac", - "digest 0.9.0", + "hmac", ] [[package]] @@ -3422,7 +3315,7 @@ version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" dependencies = [ - "digest 0.10.7", + "digest", ] [[package]] @@ -3839,15 +3732,6 @@ dependencies = [ "tempfile", ] -[[package]] -name = "instant" -version = "0.1.13" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222" -dependencies = [ - "cfg-if", -] - [[package]] name = "instant-acme" version = "0.8.5" @@ -3898,7 +3782,7 @@ dependencies = [ "clap", "fs-err", "hex_fmt", - "sha2 0.10.9", + "sha2", "sha3", ] @@ -4111,7 +3995,7 @@ dependencies = [ "ecdsa", "elliptic-curve", "once_cell", - "sha2 0.10.9", + "sha2", "signature", ] @@ -4291,7 +4175,7 @@ dependencies = [ "salsa20", "serde", "serde_json", - "sha2 0.10.9", + "sha2", "thiserror 2.0.18", "tokio", "tracing", @@ -4351,28 +4235,6 @@ dependencies = [ "tempfile", ] -[[package]] -name = "luks2" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2044d8bd5489b199890c3dbf38d4c8f50f3a5a38833986808b14e2367fe267fa" -dependencies = [ - "aes 0.7.5", - "base64 0.13.1", - "bincode 1.3.3", - "crossterm", - "hmac 0.11.0", - "pbkdf2", - "rust-argon2", - "secrecy", - "serde", - "serde-big-array 0.3.3", - "serde_json", - "sha2 0.9.9", - "thiserror 1.0.69", - "xts-mode", -] - [[package]] name = "matchers" version = "0.2.0" @@ -4395,7 +4257,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf" dependencies = [ "cfg-if", - "digest 0.10.7", + "digest", ] [[package]] @@ -4478,19 +4340,6 @@ dependencies = [ "simd-adler32", ] -[[package]] -name = "mio" -version = "0.7.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8067b404fe97c70829f082dec8bcf4f71225d7eaea1d8645349cb76fa06205cc" -dependencies = [ - "libc", - "log", - "miow", - "ntapi 0.3.7", - "winapi", -] - [[package]] name = "mio" version = "1.2.1" @@ -4503,15 +4352,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "miow" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b9f1c5b025cda876f66ef43a113f91ebc9f4ccef34843000e0adf6ebbab84e21" -dependencies = [ - "winapi", -] - [[package]] name = "mock-attestation" version = "0.6.1" @@ -4536,7 +4376,7 @@ dependencies = [ "serde_json", "sev", "sev-snp-qvl", - "sha2 0.10.9", + "sha2", "tempfile", "time", "tokio", @@ -4559,7 +4399,7 @@ dependencies = [ "equivalent", "event-listener", "futures-util", - "parking_lot 0.12.5", + "parking_lot", "portable-atomic", "smallvec", "tagptr", @@ -4725,7 +4565,7 @@ dependencies = [ "kqueue", "libc", "log", - "mio 1.2.1", + "mio", "notify-types", "walkdir", "windows-sys 0.60.2", @@ -4766,22 +4606,13 @@ dependencies = [ "pki-fetch", "rustls-pki-types", "serde", - "sha2 0.10.9", + "sha2", "tokio", "tracing", "tracing-subscriber", "x509-parser 0.16.0", ] -[[package]] -name = "ntapi" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c28774a7fd2fbb4f0babd8237ce554b73af68021b5f695a3cebd6c59bac0980f" -dependencies = [ - "winapi", -] - [[package]] name = "ntapi" version = "0.4.3" @@ -5093,7 +4924,7 @@ dependencies = [ "ecdsa", "elliptic-curve", "primeorder", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -5105,7 +4936,7 @@ dependencies = [ "ecdsa", "elliptic-curve", "primeorder", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -5146,7 +4977,7 @@ version = "3.7.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "799781ae679d79a948e13d4824a40970bfa500058d245760dd857301059810fa" dependencies = [ - "arrayvec 0.7.6", + "arrayvec", "bitvec", "byte-slice-cast", "const_format", @@ -5174,17 +5005,6 @@ version = "2.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba" -[[package]] -name = "parking_lot" -version = "0.11.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99" -dependencies = [ - "instant", - "lock_api", - "parking_lot_core 0.8.6", -] - [[package]] name = "parking_lot" version = "0.12.5" @@ -5192,21 +5012,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" dependencies = [ "lock_api", - "parking_lot_core 0.9.12", -] - -[[package]] -name = "parking_lot_core" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc" -dependencies = [ - "cfg-if", - "instant", - "libc", - "redox_syscall 0.2.16", - "smallvec", - "winapi", + "parking_lot_core", ] [[package]] @@ -5217,7 +5023,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" dependencies = [ "cfg-if", "libc", - "redox_syscall 0.5.18", + "redox_syscall", "smallvec", "windows-link 0.2.1", ] @@ -5246,15 +5052,6 @@ dependencies = [ "once_cell", ] -[[package]] -name = "pbkdf2" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d95f5254224e617595d2cc3cc73ff0a5eaf2637519e25f03388154e9378b6ffa" -dependencies = [ - "crypto-mac", -] - [[package]] name = "pear" version = "0.2.9" @@ -5768,7 +5565,7 @@ version = "0.1.0" dependencies = [ "acpi_tables", "hex", - "sha2 0.10.9", + "sha2", "thiserror 2.0.18", ] @@ -5903,7 +5700,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "sha3", "tdx-attest", "tempfile", @@ -6034,15 +5831,6 @@ dependencies = [ "yasna 0.6.0", ] -[[package]] -name = "redox_syscall" -version = "0.2.16" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a" -dependencies = [ - "bitflags 1.3.2", -] - [[package]] name = "redox_syscall" version = "0.5.18" @@ -6112,7 +5900,7 @@ dependencies = [ "hashbrown 0.16.1", "itoa", "micromap", - "parking_lot 0.12.5", + "parking_lot", "percent-encoding", "serde_json", ] @@ -6165,7 +5953,7 @@ dependencies = [ "msvc_spectre_libs", "num-bigint", "num-traits", - "parking_lot 0.12.5", + "parking_lot", "rand 0.10.1", "regex", "semver", @@ -6240,7 +6028,7 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" dependencies = [ - "hmac 0.12.1", + "hmac", "subtle", ] @@ -6348,7 +6136,7 @@ dependencies = [ "memchr", "multer", "num_cpus", - "parking_lot 0.12.5", + "parking_lot", "pin-project-lite", "rand 0.9.4", "ref-cast", @@ -6434,32 +6222,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d" dependencies = [ "const-oid", - "digest 0.10.7", + "digest", "num-bigint-dig", "num-integer", "num-traits", "pkcs1", "pkcs8", "rand_core 0.6.4", - "sha2 0.10.9", + "sha2", "signature", "spki", "subtle", "zeroize", ] -[[package]] -name = "rust-argon2" -version = "0.8.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b18820d944b33caa75a71378964ac46f58517c92b6ae5f762636247c09e78fb" -dependencies = [ - "base64 0.13.1", - "blake2b_simd", - "constant_time_eq 0.1.5", - "crossbeam-utils", -] - [[package]] name = "rustc-hash" version = "2.1.2" @@ -6767,7 +6543,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213" dependencies = [ - "cipher 0.4.4", + "cipher", ] [[package]] @@ -6845,13 +6621,13 @@ checksum = "6e9fcb6c2e176e86ec703e22560d99d65a5ee9056ae45a08e13e84ebf796296f" dependencies = [ "aead", "arrayref", - "arrayvec 0.7.6", + "arrayvec", "curve25519-dalek", "getrandom_or_panic", "merlin", "rand_core 0.6.4", "serde_bytes", - "sha2 0.10.9", + "sha2", "subtle", "zeroize", ] @@ -6891,15 +6667,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "secrecy" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bd1c54ea06cfd2f6b63219704de0b9b4f72dcc2b8fdef820be6cd799780e91e" -dependencies = [ - "zeroize", -] - [[package]] name = "security-framework" version = "3.7.0" @@ -6939,15 +6706,6 @@ dependencies = [ "serde_derive", ] -[[package]] -name = "serde-big-array" -version = "0.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cd31f59f6fe2b0c055371bb2f16d7f0aa7d8881676c04a55b1596d1a17cd10a4" -dependencies = [ - "serde", -] - [[package]] name = "serde-big-array" version = "0.5.1" @@ -7171,9 +6929,9 @@ dependencies = [ "p384", "rsa", "serde", - "serde-big-array 0.5.1", + "serde-big-array", "serde_bytes", - "sha2 0.10.9", + "sha2", "static_assertions", "uuid", "x509-cert", @@ -7214,20 +6972,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest 0.10.7", -] - -[[package]] -name = "sha2" -version = "0.9.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800" -dependencies = [ - "block-buffer 0.9.0", - "cfg-if", - "cpufeatures 0.2.17", - "digest 0.9.0", - "opaque-debug", + "digest", ] [[package]] @@ -7238,7 +6983,7 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest 0.10.7", + "digest", ] [[package]] @@ -7247,7 +6992,7 @@ version = "0.10.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874" dependencies = [ - "digest 0.10.7", + "digest", "keccak", ] @@ -7285,18 +7030,7 @@ checksum = "47106eded3c154e70176fc83df9737335c94ce22f821c32d17ed1db1f83badb1" dependencies = [ "libc", "os_pipe", - "signal-hook 0.3.18", -] - -[[package]] -name = "signal-hook" -version = "0.1.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e31d442c16f047a671b5a71e2161d6e68814012b7f5379d269ebd915fac2729" -dependencies = [ - "libc", - "mio 0.7.14", - "signal-hook-registry", + "signal-hook", ] [[package]] @@ -7325,7 +7059,7 @@ version = "2.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" dependencies = [ - "digest 0.10.7", + "digest", "rand_core 0.6.4", ] @@ -7633,7 +7367,7 @@ checksum = "3c3ffa3e4ff2b324a57f7aeb3c349656c7b127c3c189520251a648102a92496e" dependencies = [ "libc", "memchr", - "ntapi 0.4.3", + "ntapi", "objc2-core-foundation", "objc2-io-kit", "windows 0.61.3", @@ -7729,7 +7463,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tempfile", "thiserror 2.0.18", "tokio", @@ -7914,8 +7648,8 @@ checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" dependencies = [ "bytes", "libc", - "mio 1.2.1", - "parking_lot 0.12.5", + "mio", + "parking_lot", "pin-project-lite", "signal-hook-registry", "socket2 0.6.4", @@ -8110,7 +7844,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tempfile", "tpm-types", "tpm2", @@ -8134,7 +7868,7 @@ dependencies = [ "rustls-pki-types", "serde", "serde_json", - "sha2 0.10.9", + "sha2", "tpm-types", "tracing", "x509-parser 0.16.0", @@ -8157,7 +7891,7 @@ version = "0.6.1" dependencies = [ "anyhow", "hex", - "sha2 0.10.9", + "sha2", "tempfile", "tracing", ] @@ -8215,7 +7949,7 @@ dependencies = [ "matchers", "nu-ansi-term", "once_cell", - "parking_lot 0.12.5", + "parking_lot", "regex-automata", "sharded-slab", "smallvec", @@ -8631,7 +8365,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tokio", "tracing", ] @@ -8654,7 +8388,7 @@ dependencies = [ "serde", "serde-human-bytes", "serde_json", - "sha2 0.10.9", + "sha2", "tokio", "tracing", ] @@ -9354,16 +9088,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "xts-mode" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "75a099a2f21d48275314733f85bc43b6c6213b66394233aaea573fc7a520dcd9" -dependencies = [ - "byteorder", - "cipher 0.3.0", -] - [[package]] name = "yaml-rust2" version = "0.10.4" diff --git a/dstack/Cargo.toml b/dstack/Cargo.toml index 031855f4e..fef334d01 100644 --- a/dstack/Cargo.toml +++ b/dstack/Cargo.toml @@ -306,7 +306,6 @@ smallvec = "1.14.0" cmd_lib = "1.9.5" yaml-rust2 = "0.10.4" -luks2 = "0.5.0" scopeguard = "1.2.0" tar = "0.4" proxy-protocol = "0.5.0" diff --git a/dstack/dstack-util/Cargo.toml b/dstack/dstack-util/Cargo.toml index 4df0dd108..ac957a86f 100644 --- a/dstack/dstack-util/Cargo.toml +++ b/dstack/dstack-util/Cargo.toml @@ -25,6 +25,7 @@ schnorrkel.workspace = true serde.workspace = true serde-human-bytes.workspace = true serde_json.workspace = true +serde_with.workspace = true sd-notify.workspace = true sha2.workspace = true tokio = { workspace = true, features = ["full"] } @@ -59,7 +60,6 @@ bollard.workspace = true binrw.workspace = true sodiumbox.workspace = true libc.workspace = true -luks2.workspace = true nvml-wrapper.workspace = true lspci.workspace = true scopeguard.workspace = true diff --git a/dstack/dstack-util/src/system_setup.rs b/dstack/dstack-util/src/system_setup.rs index b834683c9..d4cbcfccd 100644 --- a/dstack/dstack-util/src/system_setup.rs +++ b/dstack/dstack-util/src/system_setup.rs @@ -27,9 +27,9 @@ use dstack_types::{ GpuPolicy, KeyProvider, KeyProviderInfo, GPU_ATTESTATION_OUTPUT, }; use fs_err as fs; -use luks2::{ - LuksAf, LuksConfig, LuksDigest, LuksHeader, LuksJson, LuksKdf, LuksKeyslot, LuksSegment, - LuksSegmentSize, +use luks::{ + LuksAf, LuksArea, LuksConfig, LuksDigest, LuksHeader, LuksJson, LuksKdf, LuksKeyslot, + LuksSegment, BINARY_HEADER_SIZE, }; use ra_rpc::{ client::{CertInfo, RaClient, RaClientConfig}, @@ -94,6 +94,7 @@ async fn sign_cert_request( } mod config_id_verifier; +mod luks; #[derive(clap::Parser)] /// Prepare full disk encryption @@ -3354,26 +3355,19 @@ fn validate_luks2_headers(mut reader: impl std::io::Read) -> Result { } fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> Result { - let mut hdr_data = vec![0u8; 4096]; + let mut hdr_data = vec![0u8; BINARY_HEADER_SIZE as usize]; reader .read_exact(&mut hdr_data) .context("Failed to read LUKS header")?; - let header = - LuksHeader::read_from(&mut &hdr_data[..]).context("Failed to decode LUKS header")?; let LuksHeader { magic, version, hdr_size, - seqid: _, label, csum_alg, - salt: _, - uuid: _, subsystem, hdr_offset, - csum: _, - .. - } = header; + } = LuksHeader::parse(&hdr_data).context("Failed to decode LUKS header")?; let expected_magic = match hdr_ind { 0 => [76, 85, 75, 83, 186, 190], @@ -3404,7 +3398,7 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> } // Check JSON - let json_size = hdr_size - 4096; + let json_size = hdr_size - BINARY_HEADER_SIZE; let mut jsn_data = vec![0u8; json_size as usize]; reader .read_exact(&mut jsn_data) @@ -3415,7 +3409,6 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> .unwrap_or(jsn_data.len()); jsn_data.truncate(json_end); - let json = LuksJson::read_from(&mut &jsn_data[..]).context("Failed to decode LUKS JSON")?; let LuksJson { keyslots, tokens, @@ -3423,12 +3416,11 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> digests, config: LuksConfig { - json_size: _, - keyslots_size: _, + keyslots_size, flags, requirements, }, - } = json; + } = serde_json::from_slice(&jsn_data).context("Failed to decode LUKS JSON")?; if keyslots.len() != 1 { bail!("Invalid LUKS keyslots"); @@ -3442,6 +3434,9 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> if digests.len() != 1 { bail!("Invalid LUKS digests"); } + if keyslots_size % 4096 != 0 { + bail!("Invalid LUKS keyslots size: {keyslots_size}"); + } if flags.is_some() { bail!("Invalid LUKS flags"); } @@ -3450,58 +3445,50 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> } { - let first_keyslot = keyslots.get(&0).context("no LUKS keyslot")?; - let LuksKeyslot::luks2 { + let LuksKeyslot::Luks2 { key_size, - area, + area: + LuksArea::Raw { + encryption, + key_size: area_key_size, + offset, + size, + }, kdf, - af, + af: + LuksAf::Luks1 { + hash: af_hash, + stripes, + }, priority, - } = first_keyslot; - if area.encryption() != "aes-xts-plain64" { - bail!("Invalid LUKS keyslot encryption: {}", area.encryption()); + } = keyslots.get(&0).context("no LUKS keyslot")?; + if encryption != "aes-xts-plain64" { + bail!("Invalid LUKS keyslot encryption: {encryption}"); } // Pin where the encrypted key material is read from. The binary area // must sit between the two header copies and the encrypted payload; // otherwise a host with raw disk access could redirect it elsewhere. - let area_end = area.offset().checked_add(area.size()); - if area.offset() < 2 * hdr_size || area_end.is_none_or(|end| end > PAYLOAD_OFFSET) { - bail!( - "Invalid LUKS keyslot area: offset={} size={}", - area.offset(), - area.size() - ); + let area_end = offset.checked_add(*size); + if *offset < 2 * hdr_size || area_end.is_none_or(|end| end > PAYLOAD_OFFSET) { + bail!("Invalid LUKS keyslot area: offset={offset} size={size}"); } if *key_size != 64 { bail!("Invalid LUKS keyslot key size: {key_size}"); } - if area.key_size() != 64 { - bail!("Invalid LUKS keyslot key size: {}", area.key_size()); + if *area_key_size != 64 { + bail!("Invalid LUKS keyslot key size: {area_key_size}"); } - { - let LuksKdf::pbkdf2 { - hash, - iterations: _, - // Salts are left unchecked on purpose: the passphrase is - // high-entropy and KMS-derived, so an attacker-chosen salt - // buys nothing without it (see security report #552). - salt: _, - } = kdf - else { - bail!("Invalid LUKS keyslot KDF"); - }; - if hash != "sha256" { - bail!("Invalid LUKS keyslot hash: {hash}"); - } + let LuksKdf::Pbkdf2 { hash: kdf_hash } = kdf else { + bail!("Invalid LUKS keyslot KDF"); + }; + if kdf_hash != "sha256" { + bail!("Invalid LUKS keyslot hash: {kdf_hash}"); } - { - let LuksAf::luks1 { hash, stripes } = af; - if hash != "sha256" { - bail!("Invalid LUKS keyslot hash: {hash}"); - } - if *stripes != 4000 { - bail!("Invalid LUKS keyslot stripes: {stripes}"); - } + if af_hash != "sha256" { + bail!("Invalid LUKS keyslot hash: {af_hash}"); + } + if *stripes != 4000 { + bail!("Invalid LUKS keyslot stripes: {stripes}"); } if priority.is_some() { bail!("Invalid LUKS keyslot priority"); @@ -3509,8 +3496,7 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> } { - let first_segment = segments.get(&0).context("no LUKS segment")?; - let LuksSegment::crypt { + let LuksSegment::Crypt { offset, size, iv_tweak, @@ -3518,11 +3504,11 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> sector_size, integrity, flags, - } = first_segment; + } = segments.get(&0).context("no LUKS segment")?; if *offset != PAYLOAD_OFFSET { bail!("Invalid LUKS segment offset"); } - if *size != LuksSegmentSize::dynamic { + if size != "dynamic" { bail!("Invalid LUKS segment size"); } if *iv_tweak != 0 { @@ -3542,15 +3528,11 @@ fn validate_single_luks2_header(mut reader: impl std::io::Read, hdr_ind: u64) -> } } { - let first_digest = digests.get(&0).context("no LUKS digest")?; - let LuksDigest::pbkdf2 { + let LuksDigest::Pbkdf2 { keyslots, segments, hash, - digest: _, - iterations: _, - salt: _, - } = first_digest; + } = digests.get(&0).context("no LUKS digest")?; if hash != "sha256" { bail!("Invalid LUKS digest hash: {hash}"); } diff --git a/dstack/dstack-util/src/system_setup/luks.rs b/dstack/dstack-util/src/system_setup/luks.rs new file mode 100644 index 000000000..6d0381b9e --- /dev/null +++ b/dstack/dstack-util/src/system_setup/luks.rs @@ -0,0 +1,145 @@ +// SPDX-FileCopyrightText: © 2026 Phala Network +// +// SPDX-License-Identifier: Apache-2.0 + +//! The subset of the LUKS2 on-disk format that `validate_luks2_headers` +//! checks. Fields it does not inspect are not modeled; serde ignores them. +//! See . + +use std::collections::HashMap; + +use anyhow::{Context, Result}; +use serde::{de::IgnoredAny, Deserialize}; +use serde_with::{serde_as, DisplayFromStr}; + +/// Size of the binary header that precedes each JSON area. +pub(super) const BINARY_HEADER_SIZE: u64 = 4096; + +pub(super) struct LuksHeader { + pub magic: [u8; 6], + pub version: u16, + pub hdr_size: u64, + pub label: [u8; 48], + pub csum_alg: [u8; 32], + pub subsystem: [u8; 48], + pub hdr_offset: u64, +} + +impl LuksHeader { + /// Decodes the big-endian binary header. + pub fn parse(data: &[u8]) -> Result { + fn field(data: &[u8], offset: usize) -> Result<[u8; N]> { + let bytes = data + .get(offset..offset + N) + .context("LUKS header is truncated")?; + Ok(bytes.try_into()?) + } + Ok(Self { + magic: field(data, 0)?, + version: u16::from_be_bytes(field(data, 6)?), + hdr_size: u64::from_be_bytes(field(data, 8)?), + label: field(data, 24)?, + csum_alg: field(data, 72)?, + subsystem: field(data, 208)?, + hdr_offset: u64::from_be_bytes(field(data, 256)?), + }) + } +} + +#[derive(Deserialize)] +pub(super) struct LuksJson { + pub keyslots: HashMap, + pub tokens: HashMap, + pub segments: HashMap, + pub digests: HashMap, + pub config: LuksConfig, +} + +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksKeyslot { + Luks2 { + key_size: u16, + area: LuksArea, + kdf: LuksKdf, + af: LuksAf, + #[serde(default)] + priority: Option, + }, +} + +#[serde_as] +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksArea { + Raw { + encryption: String, + key_size: u32, + #[serde_as(as = "DisplayFromStr")] + offset: u64, + #[serde_as(as = "DisplayFromStr")] + size: u64, + }, +} + +/// Salt and iterations are left unchecked on purpose: the passphrase is +/// high-entropy and KMS-derived, so attacker-chosen values buy nothing without +/// it (see security report #552). +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksKdf { + Pbkdf2 { + hash: String, + }, + #[serde(other)] + Unsupported, +} + +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksAf { + Luks1 { hash: String, stripes: u16 }, +} + +#[serde_as] +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksSegment { + Crypt { + #[serde_as(as = "DisplayFromStr")] + offset: u64, + size: String, + #[serde_as(as = "DisplayFromStr")] + iv_tweak: u64, + encryption: String, + sector_size: u16, + #[serde(default)] + integrity: Option, + #[serde(default)] + flags: Option, + }, +} + +#[serde_as] +#[derive(Deserialize)] +#[serde(tag = "type", rename_all = "lowercase")] +pub(super) enum LuksDigest { + Pbkdf2 { + #[serde_as(as = "Vec")] + keyslots: Vec, + #[serde_as(as = "Vec")] + segments: Vec, + hash: String, + }, +} + +#[serde_as] +#[derive(Deserialize)] +pub(super) struct LuksConfig { + #[serde_as(as = "DisplayFromStr")] + pub keyslots_size: u64, + #[serde(default)] + pub flags: Option, + #[serde(default)] + pub requirements: Option, +}