Skip to content

feat(mysql): make rsa dependency optional (RUSTSEC-2023-0071)#1

Merged
cmaher merged 4 commits intomainfrom
feat/mysql-rsa-optional
Mar 15, 2026
Merged

feat(mysql): make rsa dependency optional (RUSTSEC-2023-0071)#1
cmaher merged 4 commits intomainfrom
feat/mysql-rsa-optional

Conversation

@cmaher
Copy link
Owner

@cmaher cmaher commented Mar 15, 2026

Summary

  • Makes the rsa crate an opt-in feature of sqlx-mysql to address RUSTSEC-2023-0071 (Marvin Attack timing side-channel, no patched release)
  • Gates RSA-based auth (sha256_password/caching_sha2_password over non-TLS) behind features = ["rsa"]; returns a clear error when the feature is absent
  • CI and test docker-compose updated to use mysql_native_password to avoid requiring RSA

Copied entirely from launchbadge#4186

Test plan

  • Verify cargo build succeeds without rsa feature (TLS-only usage)
  • Verify cargo build --features rsa succeeds and non-TLS RSA auth works
  • Verify cargo audit no longer flags RUSTSEC-2023-0071 when rsa feature is disabled

🤖 Generated with Claude Code

Signed-off-by: Sylvain Pierrot <spierrot@aalyria.com>
Signed-off-by: Sylvain Pierrot <spierrot@aalyria.com>
…uth warnings

Signed-off-by: Sylvain Pierrot <spierrot@aalyria.com>
…ssword in CI and tests

Signed-off-by: Sylvain Pierrot <spierrot@aalyria.com>
@cmaher cmaher merged commit 4fa3bf2 into main Mar 15, 2026
140 checks passed
@cmaher cmaher deleted the feat/mysql-rsa-optional branch March 15, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants