[sbernauer]

Description

Bump the RustCrypto crates together to their new generation (x509-cert 0.3, rsa 0.10.0-rc.19, ecdsa 0.17, p256 0.14, sha2 0.11, signature 3, const-oid 0.10, rand_core 0.10), alongside semver-compatible bumps.

• Fixes RUSTSEC-2026-0387
• Pin rsa exactly, as release candidates can contain breaking changes.
• x509-cert 0.3 removed the Root and Leaf builder profiles. Port them to stackable-certs, so generated certificates stay unchanged apart from the extension order. Mark ExtendedKeyUsage as critical explicitly, as x509-cert no longer does so by default.
• Replace OsRng with UnwrapErr(SysRng) and raise the RSA test key size to 1024 bits, the new minimum.
• Use accessors for the now private x509-cert certificate fields.
• Hex-encode the sha2 digest manually in ensure_max_string_length, as it no longer implements LowerHex.
• Add FIXMEs for the infinitely recursing catch-all arms of the custom PartialEq impls in stackable-certs.

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added

[Techassi]

Partial review, I did not look at the new profile.rs and Cargo.toml files yet.

[Techassi]

One last question, good to go otherwise.