v0.101.7 preparation

[cpu]

Description

This branch targets the rel-0.101 release branch to make a point release to upgrade to ring 0.17. This will unblock a Rustls 0.21 point release that does the same.

This involves bringing the work from #193 onto the rel-0.101 branch. I didn't cherry-pick the commits directly because the restructuring of the modules in main made it more challenging to resolve conflicts than to re-implement the changes wholesale.

The rcgen update (from #189 and #195) isn't mentioned in the proposed release notes since it's a dev dependency. We also don't typically mention MSRV updates, so its omitted as well.

Proposed Release Notes

• Upgrades *ring* to 0.17, and untrusted to 0.9. Note: since unstrusted appears in the Error API this may be a breaking change for applications using two untrusted versions.

[codecov]

Codecov Report

Merging #199 (95c6e1c) into rel-0.101 (7cb6c64) will decrease coverage by 0.07%.
Report is 2 commits behind head on rel-0.101.
The diff coverage is 91.11%.

❗ Current head 95c6e1c differs from pull request most recent head e3a1b98. Consider uploading reports for the commit e3a1b98 to get more accurate results

@@              Coverage Diff              @@
##           rel-0.101     #199      +/-   ##
=============================================
- Coverage      95.09%   95.03%   -0.07%     
=============================================
  Files             16       17       +1     
  Lines           3711     3723      +12     
=============================================
+ Hits            3529     3538       +9     
- Misses           182      185       +3     

Files	Coverage Δ
src/cert.rs	92.19% <100.00%> (ø)
src/crl.rs	100.00% <100.00%> (ø)
src/der.rs	98.38% <100.00%> (+<0.01%)	⬆️
src/lib.rs	100.00% <100.00%> (ø)
src/signed_data.rs	100.00% <100.00%> (ø)
src/verify_cert.rs	96.69% <76.47%> (-0.56%)	⬇️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[djc]

Shouldn't we pick up rcgen 0.11.3 and its associated fix?

[cpu]

Shouldn't we pick up rcgen 0.11.3 and its associated fix?

That still needs to be published, 0.11.2 is the latest available. I thought it was OK to not block on that since it's a dev-dep. WDYT?

[cpu]

Shouldn't we pick up rcgen 0.11.3 and its associated fix?

That still needs to be published, 0.11.2 is the latest available.

I think it would have to be a 0.12.0 release too right? Since this commit isn't semver compatible, and ring is leaking into the public API.

[djc]

Shouldn't we pick up rcgen 0.11.3 and its associated fix?

That still needs to be published, 0.11.2 is the latest available. I thought it was OK to not block on that since it's a dev-dep. WDYT?

Yeah, probably no need to block on it. I thought 0.11.3 was the pem feature fix but looks like that was wrong.

[cpu]

I thought 0.11.3 was the pem feature fix but looks like that was wrong.

Oh, I think I'm wrong. Sorry! I was looking at the tags on the repo where 0.11.2 is the last, but we published the PEM fix to crates as 0.11.3. I'll adjust and see if I can push the missing tag on the upstream repo.

[cpu]

I'll adjust and see if I can push the missing tag on the upstream repo.

Done: https://github.com/rustls/rcgen/releases/tag/v0.11.3

[djc]

Nice!

[djc]

I think we should hold off publishing this until we're also ready to publish rustls 0.21.8 -- which maybe we want to hold off on to see if the performance regression is fixed?

[cpu]

• Pushed v/0.101.7 tag
• Published rustls-webpki v0.101.7 at registry crates-io
• Created v0.101.7 GitHub release