Skip to content

integrity-blob: move the Azure backend to object_store (RUSTSEC-2026-0275) #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
captjt merged 2 commits into from
Oct 28, 2026
Merged

integrity-blob: move the Azure backend to object_store (RUSTSEC-2026-0275) #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c305791
integrity-blob: move the Azure backend to object_store (RUSTSEC-2026-…
captjt Oct 28, 2026
0562144
CHANGELOG: link #55 and state the Azure dependency versions
captjt Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,28 @@ not always match the Git tags; section versions follow the tags.

## [Unreleased]

### Changed

- `integrity-blob`: the `blob-azure` backend moves from the legacy `azure_storage` /
`azure_storage_blobs` 0.21.0 crates to `object_store` 0.14.2 (Apache Arrow).
`AzureBlob::new` and the FFI's `ig_blob_store_azure_blob_new` keep the same
arguments and still authenticate with the storage account key. A missing blob
still reads as `None`, and puts still store a block blob with content type
`text/plain`. Requests are now retried on server errors and timeouts, connecting
times out after 5 seconds, and a key that isn't valid base64 fails at `init`
rather than on the first request.
([#55](https://github.com/eqtylab/integrity/pull/55))

### Security

- `blob-azure` no longer depends on `azure_core` 0.21, which logs each request's
`authorization` header (the Shared Key signature) at debug and trace level
(RUSTSEC-2026-0275). The legacy Azure SDK is unsupported and won't be fixed
upstream. If you ran the Azure backend with debug or trace logging enabled for the
Azure crates, treat those logs as holding credentials and rotate the storage
account key. `signer-akv` still depends on `azure_core` 0.21.
([#55](https://github.com/eqtylab/integrity/pull/55))

## [0.0.19] - 2026-10-16

### Added
Expand Down
Loading
Loading