Bump MSRV & update dependencies

.github/workflows/ci.yml

@@ -99,7 +99,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: "1.65.0" # MSRV
+          toolchain: "1.71.0" # MSRV
           components: clippy
 
       - name: Install cargo-ndk.

deny.toml

@@ -8,7 +8,7 @@ allow = [
     "ISC",
     "MIT",
     "MPL-2.0",
-    "Unicode-DFS-2016",
+    "Unicode-3.0",
 ]
 exceptions = [{ allow = ["ISC", "MIT", "OpenSSL"], name = "ring" }]
 

rustls-platform-verifier/Cargo.toml

@@ -7,7 +7,7 @@ keywords = ["tls", "certificate", "verification", "os", "native"]
 repository = "https://github.com/rustls/rustls-platform-verifier"
 license = "MIT OR Apache-2.0"
 edition = "2021"
-rust-version = "1.64.0"
+rust-version = "1.71.0"
 
 [lib]
 name = "rustls_platform_verifier"
@@ -37,7 +37,7 @@ once_cell = "1.9"
 paste = { version = "1.0", default-features = false, optional = true } # Only used when `ffi-testing` feature is enabled
 
 [target.'cfg(all(unix, not(target_os = "android"), not(target_vendor = "apple"), not(target_arch = "wasm32")))'.dependencies]
-rustls-native-certs = "0.7"
+rustls-native-certs = "0.8"
 webpki = { package = "rustls-webpki", version = "0.102", default-features = false }
 
 [target.'cfg(target_os = "android")'.dependencies]
@@ -55,9 +55,9 @@ webpki-root-certs = "0.26"
 webpki-root-certs = "0.26"
 
 [target.'cfg(any(target_vendor = "apple"))'.dependencies]
-core-foundation = "0.9"
+core-foundation = "0.10"
 core-foundation-sys = "0.8"
-security-framework = { version = "2.10", features = ["OSX_10_14"] }
+security-framework = { version = "3", features = ["OSX_10_14"] }
 security-framework-sys = { version = "2.10", features = ["OSX_10_14"] }
 
 [target.'cfg(windows)'.dependencies]

rustls-platform-verifier/src/android.rs

@@ -190,7 +190,7 @@ impl CachedClass {
     }
 
     /// Gets the cached class reference, loaded on first use
-    pub(super) fn get<'a: 'b, 'b>(&'a self, cx: &mut Context<'b>) -> Result<&JClass<'b>, Error> {
+    pub(super) fn get<'a: 'b, 'b>(&'a self, cx: &mut Context<'b>) -> Result<&'a JClass<'b>, Error> {
         let class = self.class.get_or_try_init(|| -> Result<_, Error> {
             let class = cx.load_class(self.name)?;
 

rustls-platform-verifier/src/verification/others.rs

@@ -127,34 +127,27 @@ impl Verifier {
             not(target_vendor = "apple"),
             not(target_arch = "wasm32"),
         ))]
-        match rustls_native_certs::load_native_certs() {
-            Ok(certs) => {
-                let (added, ignored) = root_store.add_parsable_certificates(certs);
-
-                if ignored != 0 {
-                    log::warn!("Some CA root certificates were ignored due to errors");
-                }
+        {
+            let result = rustls_native_certs::load_native_certs();
+            let (added, ignored) = root_store.add_parsable_certificates(result.certs);
+            if ignored != 0 {
+                log::warn!("Some CA root certificates were ignored due to errors");
+            }
 
-                if root_store.is_empty() {
-                    log::error!("No CA certificates were loaded from the system");
-                } else {
-                    log::debug!("Loaded {added} CA certificates from the system");
-                }
+            for error in result.errors {
+                log::warn!("Error loading CA root certificate: {error}");
             }
-            Err(err) => {
-                // This only contains a path to a system directory:
-                // https://github.com/rustls/rustls-native-certs/blob/bc13b9a6bfc2e1eec881597055ca49accddd972a/src/lib.rs#L91-L94
-                const MSG: &str = "failed to load system root certificates: ";
-
-                // Don't return an error if this fails when other roots have already been loaded via
-                // `new_with_extra_roots`. It leads to extra failure cases where connections would otherwise still work.
-                if root_store.is_empty() {
-                    return Err(rustls::Error::General(format!("{MSG}{err}")));
-                } else {
-                    log::error!("{MSG}{err}");
-                }
+
+            // Don't return an error if this fails when other roots have already been loaded via
+            // `new_with_extra_roots`. It leads to extra failure cases where connections would otherwise still work.
+            if root_store.is_empty() {
+                return Err(rustls::Error::General(
+                    "No CA certificates were loaded from the system".to_owned(),
+                ));
+            } else {
+                log::debug!("Loaded {added} CA certificates from the system");
             }
-        };
+        }
 
         #[cfg(target_arch = "wasm32")]
         {