build(deps): bump rust-toolchain from nightly-2025-08-24 to nightly-2025-11-06

crypto/src/mls/credential/mod.rs

@@ -312,7 +312,7 @@ mod tests {
         let new_pki_kp = PkiKeypair::rand_unchecked(case.signature_scheme());
 
         let eve_key = CertificatePrivateKey {
-            value: new_pki_kp.signing_key_bytes(),
+            value: new_pki_kp.signing_key_bytes().into(),
             signature_scheme: case.ciphersuite().signature_algorithm(),
         };
         let cb = CertificateBundle {

crypto/src/mls/credential/x509.rs

@@ -10,19 +10,17 @@ use openmls_x509_credential::CertificateKeyPair;
 use wire_e2e_identity::prelude::{HashAlgorithm, WireIdentityReader};
 #[cfg(test)]
 use x509_cert::der::Encode;
-use zeroize::Zeroize;
+use zeroize::Zeroizing;
 
 use super::{Error, Result};
 #[cfg(test)]
 use crate::test_utils::x509::X509Certificate;
 use crate::{ClientId, Credential, CredentialType, MlsError, RecursiveError, e2e_identity::id::WireQualifiedClientId};
 
-#[derive(core_crypto_macros::Debug, Clone, Zeroize)]
-#[zeroize(drop)]
+#[derive(core_crypto_macros::Debug, Clone)]
 pub struct CertificatePrivateKey {
     #[sensitive]
-    pub(crate) value: Vec<u8>,
-    #[zeroize(skip)]
+    pub(crate) value: Zeroizing<Vec<u8>>,
     pub(crate) signature_scheme: SignatureScheme,
 }
 
@@ -210,7 +208,7 @@ impl CertificateBundle {
         Self {
             certificate_chain: vec![cert.certificate.to_der().unwrap(), issuer.certificate.to_der().unwrap()],
             private_key: CertificatePrivateKey {
-                value: cert.pki_keypair.signing_key_bytes(),
+                value: cert.pki_keypair.signing_key_bytes().into(),
                 signature_scheme: cert.signature_scheme,
             },
         }

crypto/src/mls/session/mod.rs

@@ -18,7 +18,6 @@ pub(crate) use error::{Error, Result};
 pub use history_observer::HistoryObserver;
 use identities::Identities;
 use key_package::KEYPACKAGE_DEFAULT_LIFETIME;
-use log::debug;
 use mls_crypto_provider::{EntropySeed, MlsCryptoProvider};
 use openmls_traits::{OpenMlsCryptoProvider, types::SignatureScheme};
 

crypto/src/test_utils/mod.rs

@@ -81,7 +81,6 @@ macro_rules! innermost_source_matches {
         outcome
     }};
 }
-pub(crate) use innermost_source_matches;
 
 use crate::{RecursiveError::Test, ephemeral::HistorySecret, test_utils::TestError::ImplementationError};
 
@@ -208,7 +207,7 @@ impl SessionContext {
                     certificate_chain: vec![cert_der],
                     private_key: crate::mls::credential::x509::CertificatePrivateKey {
                         signature_scheme,
-                        value: actor_cert.pki_keypair.signing_key_bytes(),
+                        value: actor_cert.pki_keypair.signing_key_bytes().into(),
                     },
                 }
             }

crypto/src/transaction_context/e2e_identity/mod.rs

@@ -89,7 +89,7 @@ impl TransactionContext {
         let crl_new_distribution_points = self.extract_dp_on_init(&certificate_chain[..]).await?;
 
         let private_key = CertificatePrivateKey {
-            value: sk,
+            value: sk.into(),
             signature_scheme: cs.signature_algorithm(),
         };
 

crypto/src/transaction_context/e2e_identity/rotate.rs

@@ -155,7 +155,7 @@ impl TransactionContext {
             .map_err(RecursiveError::e2e_identity("getting certificate response"))?;
 
         let private_key = CertificatePrivateKey {
-            value: sk,
+            value: sk.into(),
             signature_scheme,
         };
 

obfuscate/Cargo.toml

@@ -12,6 +12,7 @@ openmls = { workspace = true, optional = true }
 openmls_basic_credential = { workspace = true, optional = true }
 rand.workspace = true
 sha2.workspace = true
+zeroize.workspace = true
 
 [lints]
 workspace = true

obfuscate/src/lib.rs

@@ -1,4 +1,4 @@
-use std::{fmt::Formatter, sync::LazyLock};
+use std::{fmt::Formatter, ops::Deref, sync::LazyLock};
 
 use derive_more::From;
 use log::kv::{ToValue, Value};
@@ -50,3 +50,12 @@ impl<'a, T: Obfuscate> ToValue for Obfuscated<'a, T> {
         Value::from_debug(self)
     }
 }
+
+impl<T> Obfuscate for zeroize::Zeroizing<T>
+where
+    T: Obfuscate + zeroize::Zeroize,
+{
+    fn obfuscate(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        self.deref().obfuscate(f)
+    }
+}

rust-toolchain.toml

@@ -1,5 +1,5 @@
 [toolchain]
-channel = "nightly-2025-08-24"
+channel = "nightly-2025-11-25"
 components = [
   "rust-analyzer",
   "cargo",