fix(ci): unbreak the build (russh 0.61.2), clear RustSec advisories, fix legacy-namespace test

[adolago]

Summary

Gets CI green again (issue #850) after a cascade of failures. Three areas, now all resolved:

1. The build was broken on main — Dependabot build(deps): bump the cargo group across 2 directories with 3 updates #861 bumped russh 0.55→0.57, whose forked ssh-key pulls a pre-release rsa/pkcs8 combo that doesn't compile.
2. The audit jobs — a wave of new 2026 RustSec advisories against transitive crypto crates.
3. The Test matrix — a docs test went red after Repo hygiene, CI gate hardening, panic-path fixes, and a rand 0.9 build fix #860's docs alignment.

1. Unbreak the build: russh 0.57 → 0.61.2

main stopped compiling once #861 landed. Resolving this branch's lock conflict on top required moving russh forward:

• Upgrade russh to 0.61.2. Drops the broken forked ssh-key for ssh-key 0.7, bumps russh-cryptovec→0.61 and aws-lc-sys→0.41, and removes libcrux-sha3 + the unmaintained proc-macro-error2.
• Migrate the changed agent API (russh.rs, russh_auth.rs, ssh_agent.rs): request_identities() now yields AgentIdentity; use .public_key() for auth + algorithm lookup. Test key helper rebuilt via Ed25519Keypair::from_seed (random seed) to avoid ssh-key's rand_core version coupling.
• Also drop the now-vestigial russh-keys 0.45 dep (nothing uses russh_keys::; everything goes through russh::keys).

2. Audit advisories — mostly fixed for real, not ignored

The russh 0.61 upgrade fixes 8 of the 11 advisories (aws-lc-sys ×5, libcrux-sha3, russh, russh-cryptovec) outright — so their ignores are gone. Plus rustls-webpki 0.103.8→0.103.13 (clears RUSTSEC-2026-0049).

Only the AWS SDK's bundled rustls-webpki 0.101.7 (RUSTSEC-2026-0098/0099/0104, aws feature only) stays triaged in .cargo/audit.toml/deny.toml, with a note: fix is the AWS SDK moving onto rustls 0.23.

3. Legacy-namespace docs test

test_release_docs_do_not_reference_legacy_repo_namespace forbade adolago/rustible, but that's the canonical home now; #860 moved issue links onto it and tripped the guard (all 13 Test jobs, one assertion). Retargeted the guard at the actual previous owner, kernelfirma/rustible.

Verification (local, default features)

Check	Result
cargo check --all-targets	✅
cargo audit	✅ (3 AWS-only advisories triaged; 1 informational warning)
cargo deny check licenses bans sources	✅ bans ok, licenses ok, sources ok
cargo clippy --all-targets -- -D warnings	✅ 0
cargo test --lib	✅ 2961 passed
cargo test --test docs_compatibility_sync_tests	✅ 39
bash scripts/smoke_tests.sh	✅ 3
cargo fmt --all -- --check	✅

Remaining follow-up (out of scope)

• Move the AWS SDK onto rustls 0.23 to clear the last 3 (rustls-webpki 0.101.7); then drop those ignores.

🤖 Generated with Claude Code

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Misleading russh optionality note 🐞 Bug ⛨ Security

Description

The new .cargo/audit.toml rationale says the ignored russh 0.55 advisory set is only reachable via
the optional russh feature, but Cargo.toml enables russh in the default feature set. This is
security-relevant because it can cause maintainers/users to incorrectly assume these ignored
advisories do not affect default builds.

Code

.cargo/audit.toml[R32-35]

+    # Fix requires upgrading russh to >=0.60.3, a breaking API change (Config,
+    # Preferred, kex/mac constants, Handler trait) tracked as a separate effort.
+    # russh is optional (`russh` feature) and these are SSH-path crypto issues.
+    "RUSTSEC-2026-0044",  # aws-lc-sys: X.509 name-constraints bypass

Evidence

The audit ignore block explicitly claims russh advisories are only through an optional feature,
while the crate’s default features enable russh, so the ignored advisories affect default builds.

.cargo/audit.toml[26-35]
Cargo.toml[1-7]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`.cargo/audit.toml` states that russh is optional and the ignored advisories are only reachable through the `russh` feature, but `Cargo.toml` includes `russh` in `default` features. This makes the ignore rationale inaccurate for default builds.

## Issue Context
- Current default features include `russh`, so a plain `cargo build` / default consumer build enables it.
- The ignore rationale should be accurate about whether advisories affect default builds.

## Fix Focus Areas
- .cargo/audit.toml[26-35]
- Cargo.toml[1-7]

## What to change
- Update the comment in `.cargo/audit.toml` to explicitly state that `russh` is **enabled by default** (even if it is feature-gated), so these advisories apply to default builds.
- (Optional alternative, if desired policy-wise): remove `russh` from the `default` feature set in `Cargo.toml` so the “optional feature only” rationale becomes true; if you do this, ensure docs/CI expectations are updated accordingly.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-code-review]

PR Summary by Qodo

Fix audit CI by removing unused russh-keys and documenting RustSec ignores
🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

Walkthroughs

Description

• Remove the unused russh-keys optional dependency from the russh feature.
• Triage newly failing 2026 RustSec advisories with documented, feature-scoped ignores.
• Mirror RustSec ignore lists between cargo-audit and cargo-deny configurations.

Diagram

graph TD
  A["Security audit CI jobs"] --> B[".cargo/audit.toml"] --> G[("RustSec advisory DB")]
  A --> C["deny.toml"]
  D["Cargo feature selection"] --> E["Cargo.toml"] --> F["Resolved dependency tree"] --> A

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Do the breaking upgrades now (russh >=0.60.3, AWS SDK rustls 0.23 line)

• ➕ Removes the need for ignore entries and reduces long-lived security exceptions
• ➕ Gets onto supported crypto stacks sooner
• ➖ Larger, riskier PR with API migrations and wider test surface
• ➖ May block quickly restoring CI green if migration is non-trivial

2. Temporarily exclude optional-feature trees from CI audits

• ➕ Avoids ignoring advisories globally while keeping default build strict
• ➕ Minimizes risk of shipping code with known issues in default configuration
• ➖ Requires CI workflow changes and consistent feature-matrix discipline
• ➖ Still leaves feature-enabled builds unaudited unless added back explicitly

3. Use Cargo `[patch]` / dependency overrides to force fixed transitive versions

• ➕ Can sometimes clear advisories without waiting for upstream major bumps
• ➕ Keeps dependency graph closer to current APIs
• ➖ Higher maintenance burden and potential for subtle incompatibilities
• ➖ Can diverge from upstream dependency resolution and mask upgrade pressure

Recommendation: Current approach is appropriate for unblocking CI: remove truly unused dependencies to shrink the tree, and explicitly document/justify remaining advisories that require breaking upstream upgrades. Keep the ignore blocks narrowly scoped and treat them as temporary—follow up with separate PRs for the russh and AWS/rustls major-line upgrades, then delete the corresponding ignores.

File Changes

Other (3)

audit.toml Add documented ignores for 2026 advisories in optional russh/AWS stacks +27/-0

Add documented ignores for 2026 advisories in optional russh/AWS stacks

• Extends the 'ignore' list with a grouped set of 2026 RustSec advisories tied to the optional 'russh' SSH stack and the optional AWS SDK rustls/webpki chain. Each advisory is annotated with reachability context and a concrete remediation path (major upgrades tracked separately).

.cargo/audit.toml

---

Cargo.toml Remove unused russh-keys from the russh feature and dependencies +1/-2

Remove unused russh-keys from the russh feature and dependencies

• Drops 'russh-keys' from the 'russh' feature definition and removes the optional 'russh-keys' dependency entry. This reduces the transitive dependency surface area that security tooling audits.

Cargo.toml

---

deny.toml Mirror cargo-audit RustSec ignore list for local cargo-deny runs +16/-0

Mirror cargo-audit RustSec ignore list for local cargo-deny runs

• Adds the same set of 2026 RustSec advisory IDs to 'cargo-deny''s '[advisories].ignore' list, with pointers back to '.cargo/audit.toml' for the detailed rationale. Keeps local 'cargo deny check' behavior aligned with CI audit triage.

deny.toml

---

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99dc9a4f04

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Don't ignore default-reachable russh advisories

This suppression is justified as optional, but Cargo.toml still has default = ["russh", "local"], so a normal/default build pulls russh 0.55 and its aws-lc-sys, libcrux-sha3, and russh-cryptovec stack. With these IDs ignored, both cargo audit jobs can pass while the default SSH backend remains covered by the listed vulnerabilities; either remove russh from the default set or avoid suppressing these until the default path is upgraded.

Useful? React with 👍 / 👎.