Skip to content

build(deps): replace deprecated serde_cbor with minicbor#18

Merged
hyperfinitism merged 1 commit intomainfrom
build/replace-with-minicbor
Mar 6, 2026
Merged

build(deps): replace deprecated serde_cbor with minicbor#18
hyperfinitism merged 1 commit intomainfrom
build/replace-with-minicbor

Conversation

@hyperfinitism
Copy link
Collaborator

@hyperfinitism hyperfinitism commented Mar 6, 2026

Summary

  • Replace the deprecated serde_cbor crate (archived: 2021-08-15; last release: v0.11.2) with the actively maintained minicbor for attestation document CBOR decoding
  • Remove the serde_bytes dependency which is no longer needed

Changes

  • Cargo.toml, client/Cargo.toml
    • Add minicbor
    • Remove serde_cbor and serde_bytes
  • Cargo.lock: Auto-update dependencies
  • client/src/attestation.rs
    • Replace serde_cbor::from_slice with minicbor::Decoder-based manual decoding
    • Replace serde_bytes::ByteBuf with Vec<u8>

Test

Verified end-to-end on an AWS EC2 instance m6g.xlarge (Ubuntu 24.04/AArch64) with Nitro Enclaves enabled.

Note

serde_cbor (and serde_bytes) remain in Cargo.lock as transitive dependencies of aws-nitro-enclaves-cose and aws-nitro-enclaves-nsm-api. These are outside our control and will be resolved when the upstream crates migrate.

@hyperfinitism hyperfinitism self-assigned this Mar 6, 2026
@hyperfinitism hyperfinitism added the dependencies Pull requests that update a dependency file label Mar 6, 2026
This commit replaces the deprecated serde_cbor crate with the actively
maintained minicbor crate for CBOR deserialization. The dependency on the
serde_bytes crate is also removed as it is no longer needed.
@hyperfinitism hyperfinitism force-pushed the build/replace-with-minicbor branch from 98558f7 to 8e946f0 Compare March 6, 2026 08:59
@hyperfinitism hyperfinitism merged commit b8a1904 into main Mar 6, 2026
22 checks passed
@hyperfinitism hyperfinitism deleted the build/replace-with-minicbor branch March 6, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant