chore(deps)(deps): bump rcgen from 0.13.2 to 0.14.8

[dependabot]

Bumps rcgen from 0.13.2 to 0.14.8.

Release notes

Sourced from rcgen's releases.

0.14.8

What's Changed

• Fix incorrect identifier for ML-DSA signature algorithms by @​DarkmatterVale in rustls/rcgen#412
• Upgrade yasna to 0.6 by @​djc in rustls/rcgen#419
• Add support for is_ca in CSR Params by @​5Dev24 in rustls/rcgen#420
• Add support for serializing BasicConstraints in CSR's by @​5Dev24 in rustls/rcgen#422
• update key_pair to signing_key in README.md by @​fakelozic in rustls/rcgen#427
• Fix encoding of directoryName constraints by @​sfackler in rustls/rcgen#429

0.14.7

What's Changed

• Implement From<KeyPair> for PrivateKeyDer<'static> by @​LebedevRI in rustls/rcgen#403
• update copyright year in LICENSE by @​jasmyhigh in rustls/rcgen#407
• Add P521-SHA256 and P521-SHA384 signing algorithms by @​djc in rustls/rcgen#408

0.14.6

What's Changed

• Use private cfg for docs.rs-like builds by @​ctz in rustls/rcgen#384
• Expand rustdoc for CertificateSigningRequestParams::from_der by @​dwhjames in rustls/rcgen#386
• Group imports by @​iamjpotts in rustls/rcgen#381
• examples: add signing new cert using existing ca pem files by @​iamjpotts in rustls/rcgen#379
• Tweak CSR parsing errors/documentation by @​djc in rustls/rcgen#390
• Rename invalid CSR signature error variant by @​djc in rustls/rcgen#393
• chore: fix some typos in comments by @​black5box in rustls/rcgen#395
• ci: sync cargo-check-external-types nightly by @​cpu in rustls/rcgen#399
• Forward selected crypto backend to x509-parser by @​djc in rustls/rcgen#398

0.14.5

Implement SigningKey for &impl SigningKey to make Issuer more broadly useful.

What's Changed

• Forward signing and public key data through references by @​djc in rustls/rcgen#380

0.14.4

What's Changed

• Upgrade botan to 0.12 by @​djc in rustls/rcgen#377
• Upgrade x509-parser to 0.18 by @​djc in rustls/rcgen#376
• Add unstable support for ML-DSA algorithms by @​djc in rustls/rcgen#374

0.14.3

What's Changed

• docs: fix typo in PKCS_RSA_SHA384 doc comment by @​Bravo555 in rustls/rcgen#367
• Fix regression in key usage purpose encoding by @​djc in rustls/rcgen#369

... (truncated)

Commits

• a70f083 Bump version to 0.14.8
• a32fdb1 Fix encoding of directoryName constraints
• 7111a79 update key_pair to signing_key
• 10664c9 Take semver-compatible dependency updates
• 0ec4d09 Add testing of CSR serializing basic constraints
• 5f94ef9 Add support for serializing BasicConstraints in CSR's
• fb835c1 Add writing basic constraints logic
• 0cf161d Bump codecov/codecov-action from 5 to 6
• 4909041 Add testing of CSR Params parsing Basic Constraints variants
• 6675a94 Add support for is_ca in CSR Params
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Auto-approved: all dependency bumps are patch or minor.

[github-actions]

Auto-approved: all dependency bumps are patch or minor.

[github-actions]

Auto-approved: all dependency bumps are patch or minor.

[nikhilunni]

@dependabot recreate

[engrams-agent]

✅ engrams review — complete. 2 findings posted. · View details

[github-actions]

Auto-approved: all dependency bumps are patch or minor.

[engrams-agent]

Engrams review

Verdict: 2 findings included in this summary.
Severity: Critical 0 · High 2 · Medium 0 · Low 0
Categories: 🎯 Functional Correctness: 2

View the full engrams review

Findings on the review page

crates/engram-egress-proxy/src/cert_mint.rs:L87 — rcgen 0.14 bump breaks compile: signed_by() no longer takes (cert, key) — now takes &Issuer

WHAT: The PR raises rcgen from 0.13 to 0.14 in Cargo.toml (line 265) but does not touch any source, so the 0.13-style CertificateParams::signed_by(&subject_key, &issuer_cert, &issuer_key) call no longer compiles — rcgen 0.14 changed signed_by to take a single &Issuer argument that bundles the issuer's params and signing key.

WHEN: Every build of engram-egress-proxy (and thus the whole workspace, just check, and CI) fails to compile after this bump. cert_mint.rs:87 calls params.signed_by(&leaf_kp, &ca_cert, &self.ca.key_pair) — three arguments — but the 0.14 signature is signed_by(&self, subject_key, &Issuer). The same 3-argument form is also used in the test crates/engram-sandbox-firecracker/tests/proxy_e2e.rs:106 (params.signed_by(&kp, &ca_cert, &ca_key)), which also breaks. Note this call site is the core TLS-MITM leaf-minting path for the egress proxy, so nothing that depends on rcgen can build.

Scenario:

1. Reviewer/CI checks out this PR.
2. cargo build/just check compiles engram-egress-proxy.
3. cert_mint.rs:87 fails with a wrong-arity / type-mismatch error because signed_by no longer accepts (subject_key, issuer_cert, issuer_key).

Evidence basis for the API change: the official rcgen 0.14.0 release notes (release-planning issue rustls/rcgen#357) state "signed_by() methods now take a reference to an &Issuer type that contains both the issuer's relevant certificate parameters and the signing key," and that from_ca_cert_pem/from_ca_cert_der moved from CertificateParams to Issuer.</body_md>
Update the mint path to the 0.14 API: build an rcgen::Issuer from the CA's params + key pair once (e.g. store an Issuer on Ca instead of re-self-signing), then call params.signed_by(&leaf_kp, &issuer). Also update the comment at cert_mint.rs:76-79 which still describes the old "sign API takes a &Certificate" contract, and update the test at proxy_e2e.rs:106.

crates/engram-egress-proxy/src/ca.rs:L92 — rcgen 0.14 bump breaks compile: CertificateParams::from_ca_cert_pem moved to Issuer

WHAT: The PR bumps rcgen 0.13 → 0.14 (Cargo.toml:265) without editing source, but rcgen 0.14 removed CertificateParams::from_ca_cert_pem — the CA-cert constructors were moved off CertificateParams onto the new Issuer type — so ca.rs:91 no longer compiles.

WHEN: Every build after this bump. Ca::from_pem (used by both EnvCaSource — the production/multi-host deploy path — and LocalDiskCaSource) calls CertificateParams::from_ca_cert_pem(cert_pem) at line 91. In 0.14 that associated function does not exist on CertificateParams; it is now Issuer::from_ca_cert_pem(...). The regression-guard test at ca.rs:363 (CertificateParams::from_ca_cert_pem(&cert_pem)) breaks the same way.

Scenario:

1. Build the workspace on this PR.
2. engram-egress-proxy fails to compile at ca.rs:91 (and test ca.rs:363): no such associated function from_ca_cert_pem on CertificateParams.

This function is load-bearing: the surrounding comment (ca.rs:75-90) explains that parsing the issuer DN from the loaded cert via from_ca_cert_pem is exactly what keeps leaves validating against the delivered CA. Porting it must preserve that DN-round-trip behavior, not just make it compile.

API-change basis: rcgen 0.14.0 release notes (rustls/rcgen#357): "The from_ca_cert_der() and from_ca_cert_pem() constructors that were previously attached to CertificateParams are now attached to Issuer instead."</body_md>
Port Ca to the 0.14 Issuer API: construct the issuer via Issuer::from_ca_cert_pem(cert_pem, key_pair) and store/use that Issuer for signing leaves (see the companion finding on cert_mint.rs signed_by). Preserve the DN-from-loaded-cert behavior the comment relies on, and update the test at ca.rs:363.

[engrams-agent]

✅ engrams review — complete. 0 findings posted. · View details

[engrams-agent]

Migrated to rcgen 0.14's Issuer — pushed to this branch

I took this on in today's dependency sweep. I rebased the branch onto current
main (it was 22 commits behind, and its red lanes were from 2026-05-16) and
pushed the migration as a second commit, so the updated-dependencies: trailer,
changelog link and compatibility score on the Dependabot commit are preserved.

What upstream changed

Two breaking changes, both in the CA-signing path:

1. from_ca_cert_pem moved off CertificateParams and onto the new Issuer
   type, and now takes the signing key with it:

   CertificateParams::from_ca_cert_pem(pem)  ->  Issuer::from_ca_cert_pem(pem, key)
   

   CertificateParams::from_ca_cert_der still exists but is now
   #[cfg(all(test, feature = "x509-parser"))] pub(crate) — rcgen-internal. So
   parsing a CA's params back out of its own certificate is no longer an
   available operation; the Issuer round-trip is the supported replacement.

2. signed_by takes an Issuer instead of a cert + key pair:

   params.signed_by(&pk, &issuer_cert, &issuer_key)  ->  params.signed_by(&pk, &issuer)
   

   self_signed is unchanged, except that it now takes &self, so the
   params.clone().self_signed(...) in ca.rs no longer needs the clone.

Issuer holds exactly {distinguished_name, key_identifier_method, key_usages, signing_key}.

What I migrated, and why it ends up smaller

Issuer is precisely the concept cert_mint was hand-rolling. Before, every
mint re-self-signed the CA just to obtain a &Certificate to sign against,
because 0.13's API would not accept params:

let ca_cert = self.ca.params.clone().self_signed(&self.ca.key_pair)?;  // per mint
let leaf = params.signed_by(&leaf_kp, &ca_cert, &self.ca.key_pair)?;

Now:

let issuer = self.ca.issuer()?;
let leaf = params.signed_by(&leaf_kp, &issuer)?;

So Ca drops its params field entirely and grows Ca::issuer(), which derives
the issuer from cert_pem via Issuer::from_ca_cert_pem. Net: one field and one
self-sign-per-mint removed.

The part worth reviewing closely

ca.rs carries a long comment about the Engram→Engrams DN incident, and this
is the code it is about. The invariant: X.509 path-building matches a leaf's
issuer DN to the trusted CA's subject DN — a matching public key is necessary
but not sufficient — so the issuer DN must come from the delivered cert, not
from build_params()'s constants. When a deployed CA's DN diverged from the
constant, guests failed with unable to get local issuer certificate.

That invariant is preserved, and I would argue it is now stronger. Before, it
held because from_pem remembered to parse params out of the cert — a
correct-by-convention property that the incident shows is easy to lose. Now the
only source of the DN is cert_pem, the same bytes delivered to guest trust
stores, so the DN cannot drift by construction.

Two consequences a reviewer should check:

• issuer() parses the PEM on each call rather than once at load. It is one
  PEM parse plus a borrow of the key pair, with no signing — strictly cheaper
  than the self-sign-per-mint it replaces, and leaves are cached anyway. Because
  parsing moved later, from_pem now calls issuer() once to reject a malformed
  cert at construction instead of at first connection; from_pem_rejects_malformed_cert
  covers that.

• Issuer does not expose its DN (only key() and key_usages(); the DN
  appears solely in its Debug). So the regression test could no longer compare
  ca.params.distinguished_name. Rather than weaken it, I pointed it at a real
  signed leaf: it now mints a leaf through ca.issuer() and asserts the
  delivered CN is present in the leaf's DER and the constant CN is not. That is
  the field path-building actually reads, so the test pins the property end to
  end instead of an intermediate struct field.

  I mutation-checked that guard rather than trusting it: pointing issuer() at
  Issuer::new(build_params(), ...) makes it fail with "leaf issuer DN must come
  from the loaded cert, not the constants". It has teeth.

  The !contains(CA_COMMON_NAME) assertion is discriminating because the deployed
  CN extends the constant with an s — "Engrams Egress Proxy CA" does not
  contain "Engram Egress Proxy CA". It is tied to the constant, not a literal,
  so a future CA rename keeps the test honest.

Also migrated: crates/engram-sandbox-firecracker/tests/proxy_e2e.rs (the one
other signed_by call site) now builds Issuer::from_params(&ca_params, &ca_key).
The four self_signed call sites in tests needed no change.

Verification

cargo fmt --check, cargo clippy --workspace --all-targets -D warnings and
cargo hakari verify all pass. cargo nextest run -p engram-egress-proxy is
168/168, which includes the whole intercept_e2e suite — that drives real TLS
through the proxy, so a wrong issuer DN would fail path-building there, not just
in the unit test.

One caveat on the full-workspace run, stated plainly: just check does not go
green in my sandbox, but not because of this change. 14 tests fail here —
13 in engram-harness-codex, one in engram-sandbox-process, one in
engram-agentd (harness_supervisor::…reattach…) — all subprocess-spawning
tests. I reproduced the identical set on pristine origin/main, and main's
CI run is green at 3c7b2e53, the commit this branch is rebased on. So they are
an environment limitation of my sandbox, not a regression here. None of those
crates are in rcgen's reverse-dependency closure (cargo tree -i rcgen →
egress-proxy, coordinator, host-agent, secrets-gcp, dst*, sandbox-firecracker),
so this change cannot reach them. Excluding that pre-existing set, the workspace
run is clean.

The firecracker lanes (including proxy_e2e) need KVM and cannot run in my
sandbox — please confirm the tests (firecracker …) lanes go green on this
push, since proxy_e2e is the one file I changed that I could not execute.

[engrams-agent]

Engrams review

Verdict: No findings.
Severity: Critical 0 · High 0 · Medium 0 · Low 0

View the full engrams review

[nikhilunni]

rcgen 0.14 Issuer migration reviewed: deriving the issuer from cert_pem makes the delivered-DN invariant structural, and the leaf-DER regression test pins it end to end. All lanes green.