Re: Rust pkgs with eMudhra's bad certs in webpki-roots

[pin <voidpin%protonmail.com@localhost>]

On Wednesday, October 21st, 2026 at 8:39 PM, Taylor R Campbell <riastradh%NetBSD.org@localhost> wrote:

> We have dozens of Rust packages that pull in the webpki-roots or
> webpki-root-certs crates via distinfo, and who knows how long it will
> take all the upstreams to publish new versions to update their
> Cargo.locks.
> 
> How do we deal with this systematically?  Do we have a mechanism to
> selectively replace a crate in a Rust package so we can update them
> all to 1.0.10 in one swell foop, and pull that all up to the release
> branch?


Not that I'm aware of. It depends on what 'cargo tree' says.
If it's a direct dependency, you would need to patch 'Cargo.toml' to make it use the new version.

If it's a crate dependency of a project dependency, you would need to patch 'Cargo.toml' of the vendored crate.

And if it's a crate dependency of a crate dependency of the project dependency ...
Yeah, you get the point.

But maybe there's something I'm not aware of.