fix(deps): Replace openssl with rustls in tests and experimental features

[teor2345]

Motivation

OpenSSL continues to have memory safety vulnerabilities:
GHSA-xcf7-rvmh-g6q4

zebrad isn't impacted by this one in production, because openssl is only a dependency of our tests and experimental features. But it could accidentally become a production dependency when we stabilise features or add new dependencies.

Reference

GitHub Actions ternary expressions:
https://docs.github.com/en/actions/learn-github-actions/expressions#example

Complex Code or Requirements

--all-features activates the openssl dependency, because it's an optional dependency of some of Zebra's dependencies. So I changed the CI check to ignore banned crates for --all-features. (And ignore missing dependencies for default features.)

Solution

• Ban openssl as a Zebra dependency
• Make CI check that openssl is not used in default production builds and production Docker images

Related fixes:

• Add a default-release-binaries feature to zebrad and use it in Docker files and production/prod test workflows
• Ignore expected warnings for default features and default-release-binaries
• Ban wildcard ("any version") dependencies, except in tests

Review

This is a low priority security fix.

Reviewer Checklist

• Will the PR name make sense to users?
  • Does it need extra CHANGELOG info? (new features, breaking changes, large changes)
• Are the PR labels correct?
• Does the code do what the ticket and PR says?
  • Does it change concurrent code, unsafe code, or consensus rules?
• How do you know it works? Does it have tests?

Follow Up Work

It would be good to automate keeping the duplicate dependency exception list up to date.

[codecov]

Codecov Report

Merging #7047 (1a09fc9) into main (0e0ee8d) will increase coverage by 0.00%.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7047   +/-   ##
=======================================
  Coverage   77.43%   77.44%           
=======================================
  Files         310      310           
  Lines       41694    41694           
=======================================
+ Hits        32287    32289    +2     
+ Misses       9407     9405    -2     

[gustavovalverde]

I don't think I'm following up why we would require a new feature name (default-docker) shouldn't default sentry have the same behavior? It might be confusing as why Docker needs a "special" flag.

[teor2345]

I don't think I'm following up why we would require a new feature name (default-docker) shouldn't default sentry have the same behavior? It might be confusing as why Docker needs a "special" flag.

At the moment we're repeating the sentry feature in about 4 different places in our test and production release CI workflows. And this PR adds a 5th location that's security-sensitive. (Banning OpenSSL in released binaries.)

So if we change our set of default features in released binaries, we'll need to remember to update all those locations. But we'll probably forget one!

Would it be clearer if I renamed it to something like:

• default-release-binaries
• zf-published-binaries
• zf-binary-releases

We should be using the same features for all our released binaries. Even if we're only releasing Docker binaries at the moment.

[gustavovalverde]

Understood!

I think both of this options should be good:

• default-release-binaries
• zf-binary-releases

I'd vote for the former: default-release-binaries

[teor2345]

Done, and merge conflicts resolved.

[gustavovalverde]

LGTM!