Require patched emSign trust dependencies in SDKs and consumer builds #237

Current delivery

• CLI Close superseded prerelease issues as not planned #63 is merged at 535cb6e9 / 4e377a3e. Fifteen applicable
  candidate checks and independent main Build 39906101401 pass. All actual
  CodeQL language analyses report no errors/results; its neutral aggregate
  remains explicitly separate. Composer requests select and verify the reviewed
  effective trust, while native launchers reuse the exact locked PHAR vendor
  artifact. Protected cold publisher acceptance remains required. Shared ci: require CLI Composer trust verification #242,
  merged df5f0e06 / ad78532c after all seven checks, makes the CLI guard
  mandatory without adding an App or protected-main exception.
• Rust SDK 4.2.2 is published at 47cfe6db, with OIDC publication, independent archive verification and normal Rust 1.86 installation. Manifest security floors protect fresh downstream resolution. GitHub/local publishing credential copies are removed; account-side legacy-token revocation remains a separate required action.
• Python Document uncaught Nexus caller failure coverage #197 is merged at 5cd660f2 with fixed certifi floor and OIDC publication source. 2.9.1 is not published while the account-side PyPI Trusted Publisher configuration remains outstanding.
• Rust SDK #125 is
  normally merged at 2c2f3dc8, exact qualified tree 2c0323c4 from candidate
  1c540cb2. All 17 applicable checks pass, with two explicit optional Server
  skips and zero OPEN/CONFIRMED Sonar issues. The remote head is absent.
  It selects verified effective trust before normal
  Rustup/Cargo, observer, documentation and release-tool requests. The Avro
  consumer's actual Composer client is guarded. Fresh virtual environments
  contain no pip and are populated by the bootstrapped outer pip. The new
  regression fails the preceding installer with exit 42, then passes the
  correction. Actual offline installation, 13 package controls and four mocked
  publication controls pass. Current central policy validates all workflows.
  Hosted tests pass the complete 21 entrypoint, 13 package and four release
  contracts, plus the shell checks. The real Composer 2.10.3 client verifies
  its effective CA paths and both blocked-root exclusions. Independent main
  CI 39899237522 and all applicable main checks pass. Protected run
  39899291259 passes on maintained tooling 2c2f3dc8, confirming
  already_published and a fresh exact 4.2.2 registry build on Rust 1.86.0.
  Original tag 47cfe6db stays unchanged. Its uploaded 1,726-byte evidence
  archive was not read locally after a storage-endpoint connection timeout;
  the actual job log and maintained source establish these results.
  Shared #241, merged
  1cedba66 / 6612f647 after all seven checks and with independent main
  checks passing,
  makes the existing Composer guard mandatory for this target, preventing
  removal of the last verifier from silently disabling the scan. It changes
  one policy flag and has no protected-main/App exception. No runtime, version,
  lock or package publication changes.
• Python #202
  continues CI trust closure at b75f6a33 / whole f743fdf8: ten bootstrap calls
  select reviewed effective trust, and Playwright's raw Node downloader selects
  the same clean OpenSSL paths. The central preflight preserves its closed
  reviewed input form. All 18 candidate checks pass, with zero OPEN/CONFIRMED
  Sonar findings. Normal merge 2da02a7a preserves exact tree f743fdf8;
  independent main CI 39895327290 and portal 39895327295 pass. The actual live
  portal audit matches the merge, and the remote branch is absent.
  Package/runtime/version and the separate protected
  PyPI upload job stay unchanged. Publisher/container and runner bootstrap
  boundaries still require their own qualification.
• Normal Rust dependency locks are merged through PHP Document pending activity SDK and application upgrades #205, Workflow #906 and Sample #269. Immutable CI bootstrap updates are delivered through Rust Withdrawn documentation change #123, CLI Preserve superseded prerelease authority after its successor completes #62, PHP Publish maintainer and security responsibility statements #206, AI Enforce vetted issue revisions before authority automation #25 and Website #359. AI Enforce immutable Actions and untrusted contribution boundaries #26 is normally merged at fbdc2c98 with all nine candidate checks passing. Workflow #907 is normally merged at 33f556f3, with whole tree f1816366 identical to qualified 32f40464. All 16 applicable checks pass with six explicit skips, including Sonar with zero new or accepted issues. The remote head is deleted. Its acknowledgement-test timestamp correction changes no runtime or clock budget; no package release is created for this CI change.
• Shared PR Authenticate a scoped CI trust bundle and verify Composer before requests #239 is merged at f14766da, exact tree db0087e8, with all
  seven final checks passing. Action source 75587fc3 is delivered.
  PR Require isolated hash-locked policy parser installation #240 is now ed2334a7 / 4bd8fb6b. It incorporates ci: require CLI Composer trust verification #242's CLI
  Composer target flag on top of qualified 72e1; protected workflow, parser,
  reader and issuer bytes remain unchanged. All nine fresh whole-tree checks
  pass, including both native locked-wheel cells and the actual read-only API
  exercise. Current Sonar has zero OPEN/CONFIRMED.
  Its bounded reader, issuer and
  prepared protected-main workflow bind original source, PR/head and App
  identity. A single proposed target/path/content exception cannot admit a
  changed workflow. All 104 focused controls and all nine prior 1d5 checks pass.
  S7631 is a specifically reviewed false positive: the checkout uses protected
  default-branch source, with candidate data never executed. The failed first
  analysis stays historical; the fresh same-head Sonar attempt passes with
  zero OPEN/CONFIRMED. Root source/bootstrap review, App account setup and live
  Environment/fork/wrong-issuer/stale/malformed/safe-success/rule binding
  remain unfinished. Main PT policy and credentials are unchanged. Candidate CI
  alone cannot authorize bootstrap or establish independent enforcement.
• Sample #273 is merged at 922e0c54, exact qualified tree 23bec5e4,
  following #270/#272. All 28 candidate checks pass, including both native
  production image smokes. The separate publisher 39872797679 passes all
  six jobs, with actual anonymous published-image qualification on native
  amd64/arm64, revision/attestation/decoder/startup checks and both public main
  promotions. Current index:
  sha256:3047c6f9945b27471a396dc4e145809be975967ac67b3533b019a5a253291b21.
  Independent anonymous manifest reads find matching architecture children in
  GHCR and Docker Hub. A later extra Docker Hub HEAD timed out; no registry
  cause is inferred. Earlier failed originals stay separate. Complete evidence
  is on Sample #271; Compose still builds its root image locally.
• Waterline Add worker metrics to the PHP and Rust SDKs, matching Python #233 is merged at 868cc691, exact qualified tree 50a0f4e9.
  All 34 applicable candidate checks pass, with one explicit skip and zero
  OPEN/CONFIRMED Sonar findings. Immutable tag 2.12.3 points to that merge.
  Protected publisher 39874000386 passes all four jobs. Published index
  sha256:5d1ed06761d05ce4a0cea12dde1ca85efd5787e20633253fac6bc20b69268f32
  and both children match independent anonymous registry metadata. Native
  39880866968 verifies actual CA/Brotli and service/SDK smoke on amd64 and
  arm64. Normal Composer installation, audit, source and autoload identity pass.
  2.12.3 is published. Follow-through List a run's activities from the Python and Rust clients #235 merges as 218534af, exact
  qualified tree 1cc6ed12, with 33 passing checks and four explicit skips.
  It adds automatic future native checks and updates the qualified public
  tuple/examples; package constraints and peer pins stay unchanged. Fresh main
  build 39884493147, native smoke 39884493091 and all applicable main checks
  independently pass, with four explicit skips. Earlier failures and limited protocol-fixture scope
  remain recorded; no historical image, actual-workflow or performance claim
  is promoted by these results.
• Server #666 is merged at 842d58a5, with whole tree 415e5647 identical to qualified 5f1f1cb1. It incorporates main 17dc12cd, image correction #672 and published Core 2.11.1, preparing Server 2.11.2 and Helm 0.3.2. 2.11.2 is not tagged or published. The reserved CI/release correction #673, protected gate acceptance, combined image publication and actual repair and cold-consumer acceptance remain pending. Rust retains its #673 source window.
• The original four Sample runner-store diagnostics remain failed: raw hosted Ubuntu trust contained a blocked root. They do not become passes because a later job explicitly selects a clean bundle. Remaining independent bootstrap paths, CLI cold native-build provenance, published images, normal installed upgrades and credential retirement still need delivery. No interception or artifact substitution is established.

The issue stays open for these concrete publication, bootstrap, image and token-retirement requirements. Detailed current shared-source receipt.

Problem

Current Rust SDK and consumer Cargo locks resolve affected TLS trust dependencies: webpki-roots 1.0.9 and rustls-webpki 0.103.14/0.103.15. The Python SDK also allows already installed affected certifi releases to satisfy its httpx dependency. These can retain trust paths through compromised emSign intermediates. This is an upstream dependency exposure, not evidence that a Durable Workflow installation was intercepted.

Upstream advisories and fixed versions:

• RUSTSEC-2026-0381: webpki-roots >=1.0.10.
• RUSTSEC-2026-0382: stable rustls-webpki >=0.103.16.
• GHSA-6q48-6c7w-9gw2: Python certifi>=2026.10.19.

Accepted fix and verification

• Require patched dependency floors in the Rust SDK manifest, not only its local lock: downstream library consumers must also resolve the safe versions.
• Require the fixed certifi floor in the Python SDK manifest, and prove upgrading from an already installed affected bundle selects the patched dependency. Explicit caller-supplied trust contexts remain the caller's responsibility.
• Update the SDK lock and the normal Rust fixture/worker/template locks in PHP SDK, Workflow and Sample App without changing their existing SDK pins or historical evidence.
• Preserve the Rust 1.86 minimum, normal TLS verification and configured private-CA behavior; do not disable certificate or hostname checks.
• Run locked tests and fresh-consumer dependency resolution. Publish a compatible Rust SDK patch and verify the normally installed package and rebuilt consumers.
• Keep immutable historical evidence separate. Native Server and its benchmark dependencies require their owning source qualification.
• Inspect each independent image/build trust path, including OS, Composer, Node, pip and SDK certifi. A fixed library or one clean store does not establish the others. Bootstrap active networked pip clients from the reviewed hash-pinned fixed wheel or prove their effective store is clean. Pin supported image/toolchain identities and qualify published architectures before adoption.

The published dependency floors and rebuilt artifacts, not a passing source edit alone, complete this security follow-through.