chore(deps): drop unmaintained rustls-pemfile; allow LLVM-exception

cargo-deny flagged three issues against the current advisory DB. The
cargo update commit already resolves the postgres-protocol (>=0.6.12) and
tokio-postgres (RUSTSEC-2026-0178, >=0.7.18) advisories. This commit
handles the remaining two:

- rustls-pemfile is unmaintained (RUSTSEC-2025-0134) with no safe upgrade.
  It is now a thin wrapper around rustls-pki-types, which we already depend
  on. Migrate src/tls.rs to the rustls-pki-types PemObject API
  (CertificateDer::pem_file_iter / PrivateKeyDer::from_pem_file, behind the
  `std` feature) and drop the rustls-pemfile dependency.
- Allow "Apache-2.0 WITH LLVM-exception" in deny.toml. It is pulled in via
  psm/stacker (sqlparser's recursion guard) and is Apache-2.0-compatible.

cargo deny check now reports advisories/bans/licenses/sources all ok;
build, clippy -D warnings, fmt, and the full test suite (incl. the TLS
keypair tests, against Trino 479) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lfrancke

Cargo.lock

@@ -22,8 +22,11 @@ serde_json = "1"
 trino-rust-client = "0.9"
 async-stream = "0.3"
 sqlparser = { version = "0.61", features = ["visitor"] }
-rustls-pemfile = "2"
-rustls-pki-types = "1"
+# PEM parsing uses rustls-pki-types' PemObject API directly (the `std`
+# feature provides the file-reading methods). rustls-pemfile was dropped —
+# it is unmaintained (RUSTSEC-2025-0134) and is now just a thin wrapper
+# around this same code.
+rustls-pki-types = { version = "1", features = ["std"] }
 rand = "0.10"
 
 [build-dependencies]

Cargo.toml

@@ -25,6 +25,9 @@ unused-allowed-license = "allow"
 confidence-threshold = 1.0
 allow = [
     "Apache-2.0",
+    # Apache-2.0 with the permissive LLVM compiler exception; pulled in via
+    # psm/stacker (sqlparser's recursion guard). Apache-2.0-compatible.
+    "Apache-2.0 WITH LLVM-exception",
     "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",

deny.toml

@@ -21,15 +21,14 @@
 //! provider has been installed and removes the ordering coupling between
 //! `build_acceptor` and any global init step.
 
-use std::fs::File;
-use std::io::BufReader;
 use std::path::Path;
 use std::sync::Arc;
 
 use anyhow::{Context, Result, anyhow};
 use pgwire::tokio::TlsAcceptor;
 use pgwire::tokio::tokio_rustls::rustls::ServerConfig;
 use pgwire::tokio::tokio_rustls::rustls::crypto::aws_lc_rs;
+use rustls_pki_types::pem::PemObject;
 use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 
 /// Build a `TlsAcceptor` from PEM-encoded certificate chain and private key
@@ -56,11 +55,9 @@ pub fn build_acceptor(cert_path: &Path, key_path: &Path) -> Result<TlsAcceptor>
 }
 
 fn load_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
-    let file = File::open(path)
-        .with_context(|| format!("opening TLS certificate file {}", path.display()))?;
-    let mut reader = BufReader::new(file);
-    let certs: Vec<CertificateDer<'static>> = rustls_pemfile::certs(&mut reader)
-        .collect::<std::io::Result<Vec<_>>>()
+    let certs: Vec<CertificateDer<'static>> = CertificateDer::pem_file_iter(path)
+        .with_context(|| format!("opening TLS certificate file {}", path.display()))?
+        .collect::<Result<Vec<_>, _>>()
         .with_context(|| format!("reading TLS certificate PEM {}", path.display()))?;
     if certs.is_empty() {
         return Err(anyhow!("no PEM certificates found in {}", path.display()));
@@ -69,13 +66,8 @@ fn load_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
 }
 
 fn load_key(path: &Path) -> Result<PrivateKeyDer<'static>> {
-    let file =
-        File::open(path).with_context(|| format!("opening TLS key file {}", path.display()))?;
-    let mut reader = BufReader::new(file);
-    let key = rustls_pemfile::private_key(&mut reader)
-        .with_context(|| format!("reading TLS key PEM {}", path.display()))?
-        .ok_or_else(|| anyhow!("no PEM private key found in {}", path.display()))?;
-    Ok(key)
+    PrivateKeyDer::from_pem_file(path)
+        .with_context(|| format!("reading TLS private key PEM {}", path.display()))
 }
 
 #[cfg(test)]