From 03826eb02d05c71e37b0eb2928222367d0b8df18 Mon Sep 17 00:00:00 2001
From: norrie <norrie@minimal.dev>
Date: Wed, 29 Jul 2026 09:58:01 -0700
Subject: [PATCH] build(deps): drop russh's default rsa feature

Every SSH host key this workspace generates is Ed25519, and the daemon
authenticates peers with `auth_none` gated on transport locality, so no
code path parses or verifies an RSA key. Turning off russh's default
`rsa` feature drops the `rsa` and `pkcs1` crates from the tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 Cargo.lock | 43 -------------------------------------------
 Cargo.toml |  2 +-
 deny.toml  |  2 --
 3 files changed, 1 insertion(+), 46 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4b90ed8c3..7ba79c9df 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1252,16 +1252,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "crypto-primes"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
-dependencies = [
- "crypto-bigint",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "ctr"
 version = "0.10.1"
@@ -4776,16 +4766,6 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
-[[package]]
-name = "pkcs1"
-version = "0.8.0-rc.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "986d2e952779af96ea048f160fd9194e1751b4faea78bcf3ceb456efe008088e"
-dependencies = [
- "der",
- "spki",
-]
-
 [[package]]
 name = "pkcs5"
 version = "0.8.1"
@@ -5504,25 +5484,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "rsa"
-version = "0.10.0-rc.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
-dependencies = [
- "const-oid",
- "crypto-bigint",
- "crypto-primes",
- "digest 0.11.3",
- "pkcs1",
- "pkcs8",
- "rand_core 0.10.1",
- "sha2 0.11.0",
- "signature 3.0.0",
- "spki",
- "zeroize",
-]
-
 [[package]]
 name = "russh"
 version = "0.62.4"
@@ -5568,13 +5529,11 @@ dependencies = [
  "p521",
  "pageant",
  "pbkdf2",
- "pkcs1",
  "pkcs5",
  "pkcs8",
  "polyval",
  "rand",
  "rand_core 0.10.1",
- "rsa",
  "russh-cryptovec",
  "russh-util",
  "salsa20",
@@ -6355,7 +6314,6 @@ checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e"
 dependencies = [
  "base64ct",
  "bytes",
- "crypto-bigint",
  "ctutils",
  "digest 0.11.3",
  "pem-rfc7468",
@@ -6378,7 +6336,6 @@ dependencies = [
  "p384",
  "p521",
  "rand_core 0.10.1",
- "rsa",
  "sec1",
  "sha1",
  "sha2 0.11.0",
diff --git a/Cargo.toml b/Cargo.toml
index 43e176c75..ea8e940f6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -137,7 +137,7 @@ prost = "0.14"
 prost-build = "0.14"
 prost-types = "0.14"
 resolv-conf = "0.7"
-russh = "0.62"
+russh = { version = "0.62", default-features = false, features = ["aws-lc-rs", "flate2"] }
 russh-sftp = "2.1"
 serde_json = { version = "1.0" }
 serial_test = "4"
diff --git a/deny.toml b/deny.toml
index 1a1e4bae7..c2db3ea25 100644
--- a/deny.toml
+++ b/deny.toml
@@ -7,8 +7,6 @@ ignore = [
     "RUSTSEC-2026-0009",
     # Deprecation notice of paste crate
     "RUSTSEC-2024-0436",
-    # RSA crate timing side-channel, not accessible when using ed25519 host keys
-    "RUSTSEC-2023-0071",
     # proc-macro-error2 is no longer maintained. oci-spec depends on getset which depends on it
     # Ignore until it is replaced upstream
     "RUSTSEC-2026-0173",