Backport glib VariantStrIter security fix

.github/workflows/ci.yml

@@ -71,6 +71,7 @@ jobs:
             tools.release.test_direct_distribution \
             tools.release.test_package_macos \
             tools.release.test_package_windows_store \
+            tools.release.test_rust_dependency_security \
             tools.site.test_index_contract \
             tools.site.test_store_readiness_contract \
             tools.deploy.test_nine_inbox_contract \

.gitlab-ci.yml

@@ -90,6 +90,7 @@ python-contracts:
       tools.release.test_package_macos
       tools.release.test_direct_distribution
       tools.release.test_package_windows_store
+      tools.release.test_rust_dependency_security
       tools.site.test_index_contract
       tools.site.test_store_readiness_contract
       tools.deploy.test_nine_inbox_contract

tools/ci/test_ci_workflow_contract.py

@@ -55,6 +55,7 @@ def test_project_contracts_cover_public_surfaces(self):
             "python -m unittest discover -s bot/tests -p 'test_*.py'",
             "python -m unittest \\",
             "tools.release.test_package_macos",
+            "tools.release.test_rust_dependency_security",
             "tools.site.test_index_contract",
             "tools.deploy.test_nine_inbox_contract",
             "tools.deploy.test_open_miner_contract",
@@ -82,6 +83,7 @@ def test_gitlab_mirror_runs_core_contracts_and_security_scanners(self):
             "node tools/desktop/verify-wallet-edition.mjs btc09-wallet-core",
             "node --test tools/mobile/*.test.mjs",
             "python -m unittest discover -s bot/tests -p 'test_*.py'",
+            "tools.release.test_rust_dependency_security",
         ):
             with self.subTest(token=token):
                 self.assertIn(token, self.gitlab)

tools/release/test_rust_dependency_security.py

@@ -0,0 +1,39 @@
+import pathlib
+import tomllib
+import unittest
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+TAURI_MANIFEST = ROOT / "walletapp" / "src-tauri" / "Cargo.toml"
+TAURI_LOCK = ROOT / "walletapp" / "src-tauri" / "Cargo.lock"
+VENDORED_GLIB = ROOT / "walletapp" / "vendor" / "glib-0.18.5-btc09"
+
+
+class RustDependencySecurityTests(unittest.TestCase):
+    def test_patched_glib_source_is_locked(self):
+        manifest = tomllib.loads(TAURI_MANIFEST.read_text(encoding="utf-8"))
+        patch = manifest["patch"]["crates-io"]["glib"]
+        self.assertEqual(patch, {"path": "../vendor/glib-0.18.5-btc09"})
+
+        lock = tomllib.loads(TAURI_LOCK.read_text(encoding="utf-8"))
+        packages = [package for package in lock["package"] if package["name"] == "glib"]
+        self.assertEqual(len(packages), 1)
+        self.assertEqual(packages[0]["version"], "0.18.5")
+        self.assertNotIn("source", packages[0])
+        self.assertNotIn("checksum", packages[0])
+
+    def test_variant_string_iterator_uses_mutable_out_pointer(self):
+        source = (VENDORED_GLIB / "src" / "variant_iter.rs").read_text(encoding="utf-8")
+        self.assertIn("let mut p: *mut libc::c_char = std::ptr::null_mut();", source)
+        self.assertIn("&mut p,", source)
+        self.assertNotIn("\n                &p,", source)
+
+    def test_backport_provenance_is_recorded(self):
+        provenance = (VENDORED_GLIB / "BTC09-PATCH.md").read_text(encoding="utf-8")
+        self.assertIn("GHSA-wrw7-89jp-8q8g", provenance)
+        self.assertIn("05dff0ee696f9bcd8617cd48c4b812d046d440cb", provenance)
+        self.assertIn("233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5", provenance)
+
+
+if __name__ == "__main__":
+    unittest.main()

walletapp/src-tauri/Cargo.toml

@@ -27,3 +27,6 @@ url = "2.5.8"
 [target.'cfg(any(target_os = "android", target_os = "ios"))'.dependencies]
 tauri-plugin-wallet-core = { path = "../plugins/tauri-plugin-wallet-core" }
 tauri-plugin-barcode-scanner = "=2.4.5"
+
+[patch.crates-io]
+glib = { path = "../vendor/glib-0.18.5-btc09" }

walletapp/vendor/glib-0.18.5-btc09/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "42b9caf98e03ded086362d9653ca58fe94dc8658"
+  },
+  "path_in_vcs": "glib"
+}

walletapp/vendor/glib-0.18.5-btc09/BTC09-PATCH.md

@@ -0,0 +1,20 @@
+# BTC09 glib security backport
+
+This directory contains the official `glib` 0.18.5 crate with the upstream
+`VariantStrIter::impl_get` security fix backported. It is used only by the
+Linux Tauri/GTK wallet dependency graph.
+
+- Upstream crate: https://crates.io/crates/glib/0.18.5
+- Archive SHA-256: `233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5`
+- Advisory: https://github.com/advisories/GHSA-wrw7-89jp-8q8g
+- Upstream fix: https://github.com/gtk-rs/gtk-rs-core/pull/1343
+- Upstream merge commit: `05dff0ee696f9bcd8617cd48c4b812d046d440cb`
+- License: MIT, preserved in `LICENSE`
+
+The backport changes the C out-argument from `&p` to `&mut p` and makes the
+pointer binding mutable. No other upstream source is modified.
+
+Tauri 2.11 still depends on the GTK3 crate line that requires `glib` 0.18, so
+the patched upstream `glib` 0.20 release cannot replace it through a normal
+semver update. Remove this override when the supported Tauri Linux dependency
+graph moves to `glib` 0.20 or newer.

walletapp/vendor/glib-0.18.5-btc09/COPYRIGHT

@@ -0,0 +1,14 @@
+The gtk-rs Project is licensed under the MIT license, see the LICENSE file or
+<http://opensource.org/licenses/MIT>.
+
+Copyrights in the gtk-rs Project project are retained by their contributors.
+No copyright assignment is required to contribute to the gtk-rs Project
+project.
+
+For full authorship information, see the version control history.
+
+This project provides interoperability with various GNOME libraries but
+doesn't distribute any parts of them. Distributing compiled libraries and
+executables that link to those libraries may be subject to terms of the GNU
+LGPL or other licenses. For more information check the license of each GNOME
+library.

walletapp/vendor/glib-0.18.5-btc09/Cargo.toml

@@ -0,0 +1,185 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+rust-version = "1.70"
+name = "glib"
+version = "0.18.5"
+authors = ["The gtk-rs Project Developers"]
+exclude = ["gir-files/*"]
+description = "Rust bindings for the GLib library"
+homepage = "https://gtk-rs.org/"
+documentation = "https://gtk-rs.org/gtk-rs-core/stable/latest/docs/glib/"
+readme = "README.md"
+keywords = [
+    "glib",
+    "gtk-rs",
+    "gnome",
+    "GUI",
+]
+license = "MIT"
+repository = "https://github.com/gtk-rs/gtk-rs-core"
+
+[package.metadata.docs.rs]
+all-features = true
+rustc-args = [
+    "--cfg",
+    "docsrs",
+]
+rustdoc-args = [
+    "--cfg",
+    "docsrs",
+    "--generate-link-to-definition",
+]
+
+[lib]
+name = "glib"
+
+[[test]]
+name = "subclass_compiletest"
+required-features = ["compiletests"]
+
+[[bench]]
+name = "gstring"
+harness = false
+
+[dependencies.bitflags]
+version = "2.3"
+
+[dependencies.ffi]
+version = "0.18"
+package = "glib-sys"
+
+[dependencies.futures-channel]
+version = "0.3"
+
+[dependencies.futures-core]
+version = "0.3"
+default-features = false
+
+[dependencies.futures-executor]
+version = "0.3"
+
+[dependencies.futures-task]
+version = "0.3"
+default-features = false
+
+[dependencies.futures-util]
+version = "0.3"
+
+[dependencies.gio_ffi]
+version = "0.18"
+optional = true
+package = "gio-sys"
+
+[dependencies.glib-macros]
+version = "0.18"
+
+[dependencies.gobject_ffi]
+version = "0.18"
+package = "gobject-sys"
+
+[dependencies.libc]
+version = "0.2"
+
+[dependencies.memchr]
+version = "2.5.0"
+
+[dependencies.once_cell]
+version = "1.0"
+
+[dependencies.rs-log]
+version = "0.4"
+optional = true
+package = "log"
+
+[dependencies.smallvec]
+version = "1.0"
+features = [
+    "union",
+    "const_generics",
+    "const_new",
+]
+
+[dependencies.thiserror]
+version = "1"
+
+[dev-dependencies.criterion]
+version = "0.5.1"
+
+[dev-dependencies.gir-format-check]
+version = "^0.1"
+
+[dev-dependencies.tempfile]
+version = "3"
+
+[dev-dependencies.trybuild2]
+version = "1"
+
+[features]
+compiletests = []
+default = ["gio"]
+gio = ["gio_ffi"]
+log = ["rs-log"]
+log_macros = ["log"]
+v2_58 = [
+    "ffi/v2_58",
+    "gobject_ffi/v2_58",
+]
+v2_60 = [
+    "v2_58",
+    "ffi/v2_60",
+]
+v2_62 = [
+    "v2_60",
+    "ffi/v2_62",
+    "gobject_ffi/v2_62",
+]
+v2_64 = [
+    "v2_62",
+    "ffi/v2_64",
+]
+v2_66 = [
+    "v2_64",
+    "ffi/v2_66",
+    "gobject_ffi/v2_66",
+]
+v2_68 = [
+    "v2_66",
+    "ffi/v2_68",
+    "gobject_ffi/v2_68",
+]
+v2_70 = [
+    "v2_68",
+    "ffi/v2_70",
+    "gobject_ffi/v2_70",
+]
+v2_72 = [
+    "v2_70",
+    "ffi/v2_72",
+    "gobject_ffi/v2_72",
+]
+v2_74 = [
+    "v2_72",
+    "ffi/v2_74",
+    "gobject_ffi/v2_74",
+]
+v2_76 = [
+    "v2_74",
+    "ffi/v2_76",
+    "gobject_ffi/v2_76",
+]
+v2_78 = [
+    "v2_76",
+    "ffi/v2_78",
+    "gobject_ffi/v2_78",
+]