[Nic-dorman]

Linear issue

Closes V2-1662

Part of V2-1659, which tracks the same move across every affected WithAutonomi lockfile.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposed rather than asserted. Lockfile only: 2 existing entries move within their semver range, each with the same dependency list as the version it replaces: rustls-webpki 0.103.15 → 0.103.16 (rust-version 1.71 on both sides), one patch release, and webpki-root-certs 1.0.8 → 1.0.10, two patch releases, whose rust-version rises from 1.70 to 1.71. Both stay below ant-protocol's own rust-version (1.91). The one behaviour change is that TLS certificate paths through the distrusted emSign intermediates, or the removed emSign ECC Root CA - G3 root, no longer verify. No Autonomi protocol message changes. Same tier as the earlier rustls lockfile moves (ant-client#232, ant-node#256, ant-protocol#46, saorsa-core#177, saorsa-transport#190).

Compatibility

• Wire: none for the Autonomi protocol. For TLS, chains through the distrusted emSign intermediates now fail verification.
• Storage: none.
• API: none. No manifest or source file is touched; this is the lockfile only.

Semver impact

• breaking
• feature
• fix

Test evidence

Run on this branch: one commit on top of main at 927c7e5. RustSec database at 4b587f00 (2026-10-21), cargo-audit 0.22.1, cargo 1.97.1.

• cargo audit -f <lockfile>: on main's lockfile it reports RUSTSEC-2026-0382, RUSTSEC-2026-0383; on this branch none of them, and every other finding is unchanged.
• The diff is exactly the version and checksum lines of the moved entries: Cargo.lock 8 lines. No entry is added or removed.
• cargo metadata --locked accepts every changed lockfile. Each moved release has the same dependency list as the version it replaces, checked entry by entry.
• Not run locally: builds, Clippy and tests are left to this PR's CI. No production compat smoke was run, because nothing on an Autonomi protocol path changes.

New dependency

None. Two existing lockfile entries move within their semver range; none is added or removed.

ADR

n/a, Tier 1.

Mitigation / rollback

Revert the commit. It touches only lockfiles, so there is nothing to migrate either way.

---

What this is

Three RustSec advisories published on 2026-10-19 and 2026-10-20 cover one incident, CVE-2026-111943: the private keys of some emSign intermediate CAs are now well known, so certificate paths through them must stop verifying. This lockfile is affected by:

• RUSTSEC-2026-0382 (rustls-webpki, fixed in 0.103.16): rejects certificate paths that contain the distrusted emSign intermediate public keys.
• RUSTSEC-2026-0383 (webpki-root-certs, fixed in 1.0.10): drops the emSign ECC Root CA - G3 root.

Lockfile	Moves
Cargo.lock	rustls-webpki 0.103.15 → 0.103.16, webpki-root-certs 1.0.8 → 1.0.10

rustls-webpki is rustls's certificate-path verifier, compiled in through rustls, rustls-platform-verifier and rustls-post-quantum. webpki-root-certs is the bundled root store rustls-platform-verifier uses.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

Review — Changes requested

Reviewed revision: ce681ed6d9b1f00d2235cb7581bd7f2b0ce74833
Coverage: 1/1 seat reviewed (sol-1, gpt-6.1-sol, xhigh). The seat found no source-level defect.

Required: confirm the risk tier and complete its gate

The repository template (.github/PULL_REQUEST_TEMPLATE.md:19-27) says a human confirms the tier. T1 is for client-only changes with no network-facing behaviour change and requires a production compatibility smoke. T2 covers a behaviour change and requires a dev testnet plus an ADR.

This lockfile update changes TLS certificate verification outcomes: Cargo.lock:4293 updates rustls-webpki, and Cargo.lock:5566 updates webpki-root-certs. The PR description also says affected emSign chains will stop verifying. It marks T1 but reports that no production compatibility smoke ran, and it leaves the ADR as n/a. Please have a human reviewer confirm the correct tier, align the description, and provide the validation required for that tier before approval.

This is an acceptance-evidence request, not a finding that the two lockfile entries are incorrect. The base lockfile reports RUSTSEC-2026-0382 and RUSTSEC-2026-0383; the head clears them. All 12 current CI checks pass.

[MaidSafe-Hermes]

Review — Approved

Reviewed revision: ce681ed6d9b1f00d2235cb7581bd7f2b0ce74833
Coverage: 1/1 seat reviewed (sol-1, gpt-6.1-sol, xhigh).

The lockfile changes only the versions and checksums of rustls-webpki and webpki-root-certs. Their dependency lists are unchanged. The base lockfile reports RUSTSEC-2026-0382 and RUSTSEC-2026-0383; the head clears both. cargo metadata --locked passes, and all 15 current check runs pass.

Risk gate: Nic confirmed T1 and waived the production compatibility smoke for this PR in the Slack review thread. The TLS trust change intentionally rejects the affected emSign certificate paths. No source-level blocker remains.