Update latest openmls

[tylerhawkes]

This includes the backwards incompatible changes that were breaking us previously, along with some updates to dependencies that had rust security advisories.

Note

Add MlsGroup::propose_self_update_with_new_signer for signature key rotation in MLS groups

• Adds propose_self_update_with_new_signer to MlsGroup allowing a member to rotate their signature key via an Update proposal, with validation for ciphersuite and credential consistency.
• Refactors MessageSecretsWithTimestamp wrapper away by moving the optional timestamp directly onto MessageSecrets via new timestamp() and with_timestamp() accessors.
• Changes safe_export_secret parameter type from u16 to ComponentId across MlsGroup, StagedCommit, ProcessedMessage, and ApplicationExportTree.
• Removes debug_assert!(false) panics in debug builds from confirmation tag mismatch and AEAD decryption error paths.
• Updates PastEpochDeletionPolicy serde to use custom impls, encoding KeepAll as usize::MAX (u64) rather than an untagged enum.
• Workspace now includes sqlite_storage instead of sqlx_storage; bumps rayon, rusqlite, tokio, clap, and RustCrypto dependencies (sha2, hmac, hkdf).
• Risk: Serialization format for stored MessageSecrets and PastEpochDeletionPolicy has changed; existing persisted state may need migration.

📊 Macroscope summarized 3bb3e4b. 30 files reviewed, 4 issues evaluated, 0 issues filtered, 2 comments posted

🗂️ Filtered Issues

[macroscopeapp]

🟡 Medium mls_group/config.rs:74

Serializing KeepAll uses usize::MAX cast to u64, which produces different values on 32-bit (4294967295) vs 64-bit (18446744073709551615) platforms. When serialized on 32-bit and deserialized on 64-bit, 4294967295 != usize::MAX, so KeepAll incorrectly becomes MaxEpochs(4294967295). Conversely, serializing on 64-bit produces u64::MAX which fails usize::try_from() on 32-bit. Consider using a fixed sentinel value like u64::MAX in serialization, checking for that sentinel explicitly during deserialization.

-        let usize = match self {
-            Self::MaxEpochs(epochs) => *epochs,
-            Self::KeepAll => usize::MAX,
-        };
-        serializer.serialize_u64(usize as u64)
+        let value = match self {
+            Self::MaxEpochs(epochs) => *epochs as u64,
+            Self::KeepAll => u64::MAX,
+        };
+        serializer.serialize_u64(value)

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file openmls/src/group/mls_group/config.rs around lines 74-78:

Serializing `KeepAll` uses `usize::MAX` cast to `u64`, which produces different values on 32-bit (`4294967295`) vs 64-bit (`18446744073709551615`) platforms. When serialized on 32-bit and deserialized on 64-bit, `4294967295 != usize::MAX`, so `KeepAll` incorrectly becomes `MaxEpochs(4294967295)`. Conversely, serializing on 64-bit produces `u64::MAX` which fails `usize::try_from()` on 32-bit. Consider using a fixed sentinel value like `u64::MAX` in serialization, checking for that sentinel explicitly during deserialization.

Evidence trail:
openmls/src/group/mls_group/config.rs lines 71-93 at REVIEWED_COMMIT: Serialize impl at line 74 uses `usize::MAX as u64` for KeepAll; Deserialize impl at line 84 uses `usize::try_from(epochs)` then compares to `usize::MAX`. usize::MAX differs between 32-bit (2^32-1) and 64-bit (2^64-1) platforms, causing cross-platform serialization/deserialization mismatch.

[macroscopeapp]

🟡 Medium

openmls/openmls/src/group/mls_group/past_secrets.rs

Line 299 in 3bb3e4b

pub(crate) fn delete_past_epoch_secrets(&mut self, policy: PastEpochDeletion) {

In delete_past_epoch_secrets, when policy.config is None (from PastEpochDeletion::delete_all()), the max_past_epochs field is silently ignored. Calling PastEpochDeletion::delete_all().max_past_epochs(5) deletes all entries instead of preserving 5, because the max_past_epochs handling is only inside the if let Some(config) branch. Move the max_past_epochs check outside the if/else so it applies regardless of whether config is None.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file openmls/src/group/mls_group/past_secrets.rs around line 299:

In `delete_past_epoch_secrets`, when `policy.config` is `None` (from `PastEpochDeletion::delete_all()`), the `max_past_epochs` field is silently ignored. Calling `PastEpochDeletion::delete_all().max_past_epochs(5)` deletes all entries instead of preserving 5, because the `max_past_epochs` handling is only inside the `if let Some(config)` branch. Move the `max_past_epochs` check outside the `if/else` so it applies regardless of whether `config` is `None`.

Evidence trail:
openmls/src/group/mls_group/past_secrets.rs lines 299-322 (delete_past_epoch_secrets function where max_past_epochs check is inside the if-let branch); openmls/src/group/mls_group/config.rs lines 114-167 (PastEpochDeletion struct definition, delete_all() returns config: None, and max_past_epochs() builder method is public and chainable)

[macroscopeapp]

Approvability

Verdict: Needs human review

2 blocking correctness issues found. This PR introduces new signature key rotation functionality, changes serialization formats affecting backwards compatibility, and has two unresolved review comments identifying bugs. Additionally, the author does not own any of the modified files which are all designated to @openmls/core.

^{You can customize Macroscope's approvability policy. Learn more.}