chore: Switch to rustls-pki-types to resolve RUSTSEC-2025-0134 (#796)

Author: sbernauer

Cargo.lock

@@ -31,7 +31,7 @@ moka = { version = "0.12", features = ["future"] }
 native-tls = "0.2.12"
 pin-project = "1.1"
 reqwest = { version = "0.12", features = ["json"] }
-rustls-pemfile = "2.1"
+rustls-pki-types = "1.13"
 semver = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"

Cargo.nix

@@ -24,7 +24,7 @@ moka.workspace = true
 native-tls.workspace = true
 pin-project.workspace = true
 reqwest.workspace = true
-rustls-pemfile.workspace = true
+rustls-pki-types.workspace = true
 semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true

Cargo.toml

@@ -1,5 +1,6 @@
 use std::{io::Cursor, path::Path};
 
+use rustls_pki_types::{CertificateDer, pem::PemObject};
 use snafu::{ResultExt as _, Snafu};
 use stackable_operator::commons::tls_verification::TlsClientDetails;
 use tokio::{fs::File, io::AsyncReadExt};
@@ -13,7 +14,9 @@ pub enum Error {
     ParseCaBundleReqwest { source: reqwest::Error },
 
     #[snafu(display("failed to split ca certificate bundle"))]
-    SplitCaBundle { source: std::io::Error },
+    SplitCaBundle {
+        source: rustls_pki_types::pem::Error,
+    },
 
     #[snafu(display("failed to parse ca certificate (via native_tls)"))]
     ParseCaCertNativeTls { source: native_tls::Error },
@@ -58,11 +61,12 @@ pub async fn configure_native_tls(
     } else if let Some(tls_ca_cert_mount_path) = tls.tls_ca_cert_mount_path() {
         builder.disable_built_in_roots(true);
         // native-tls doesn't support parsing CA *bundles*, so split them using rustls first
-        for ca_cert in rustls_pemfile::certs(&mut Cursor::new(
+        let mut pem_bytes = Cursor::new(
             read_file(&tls_ca_cert_mount_path)
                 .await
                 .context(ReadCaBundleSnafu)?,
-        )) {
+        );
+        for ca_cert in CertificateDer::pem_reader_iter(&mut pem_bytes) {
             builder.add_root_certificate(
                 native_tls::Certificate::from_der(&ca_cert.context(SplitCaBundleSnafu)?)
                     .context(ParseCaCertNativeTlsSnafu)?,