fix: update google cloud dependencies that do not depend on rsa (matt…

…er-labs#622)

## What ❔

This PR updates the dependencies of `google-cloud-storage` and
`google-cloud-auth`. The changes are as follows:

- From google-cloud-storage = "0.12.0" to google-cloud-storage =
"0.15.0"
- From google-cloud-auth = "0.11.0" to google-cloud-auth = "0.13.0"

Relevant google-cloud changes:
yoshidan/google-cloud-rust#217

## Why ❔

<!-- Why are these changes done? What goal do they contribute to? What
are the principles behind them? -->
<!-- Example: PR templates ensure PR reviewers, observers, and future
iterators are in context about the evolution of repos. -->

The primary reason for these updates is to address a security
vulnerability associated with the `rsa` crate, as indicated by a recent
`cargo-deny` check. The vulnerability (Marvin Attack, RUSTSEC-2023-0071)
was detected in rsa v0.6.1, which is a dependency of
`google-cloud-storage v0.12.0`. By updating to `google-cloud-storage
v0.15.0`, we eliminate the use of the `rsa` crate, as the newer version
of `google-cloud-storage` does not depend on it. Similarly,
`google-cloud-auth` is updated for compatibility.

Cargo deny output:

```
error[vulnerability]: Marvin Attack: potential key recovery through timing sidechannels
    ┌─ /Users/dustinbrickwood/Documents/dev/dut/forks/foundry-zksync/Cargo.lock:759:1
    │
759 │ rsa 0.6.1 registry+https://github.com/rust-lang/crates.io-index
    │ --------------------------------------------------------------- security vulnerability detected
    │
    = ID: RUSTSEC-2023-0071
    = Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0071
    = ### Impact
      Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

      ### Patches
      No patch is yet available, however work is underway to migrate to a fully constant-time implementation.

      ### Workarounds
      The only currently available workaround is to avoid using the `rsa` crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer is fine.

      ### References
      This vulnerability was discovered as part of the "[Marvin Attack]", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

      [Marvin Attack]: https://people.redhat.com/~hkario/marvin/
    = Announcement: RustCrypto/RSA#19 (comment)
    = Solution: No safe upgrade is available!
    = rsa v0.6.1
      └── google-cloud-storage v0.12.0
          └── zksync_object_store v0.1.0
              ├── zksync_core v0.1.0
              │   └── era_test_node v0.1.0-alpha.12
              │       └── era_revm v0.0.1-alpha
              │           ├── foundry-common v0.2.0
              │           │   ├── anvil v0.2.0
              │           │   │   ├── (dev) forge v0.2.0
              │           │   │   └── (dev) zkforge v0.2.0
              │           │   ├── cast v0.2.0
              │           │   ├── chisel v0.2.0
              │           │   ├── forge v0.2.0 (*)
              │           │   ├── foundry-cli v0.2.0
              │           │   │   ├── cast v0.2.0 (*)
              │           │   │   ├── chisel v0.2.0 (*)
              │           │   │   ├── forge v0.2.0 (*)
              │           │   │   ├── zkcast v0.2.0
              │           │   │   │   └── zkforge v0.2.0 (*)
              │           │   │   └── zkforge v0.2.0 (*)
              │           │   ├── foundry-debugger v0.2.0
              │           │   │   ├── forge v0.2.0 (*)
              │           │   │   ├── foundry-cli v0.2.0 (*)
              │           │   │   └── zkforge v0.2.0 (*)
              │           │   ├── foundry-evm v0.2.0
              │           │   │   ├── anvil v0.2.0 (*)
              │           │   │   ├── anvil-core v0.2.0
              │           │   │   │   └── anvil v0.2.0 (*)
              │           │   │   ├── cast v0.2.0 (*)
              │           │   │   ├── chisel v0.2.0 (*)
              │           │   │   ├── forge v0.2.0 (*)
              │           │   │   ├── foundry-cli v0.2.0 (*)
              │           │   │   ├── foundry-debugger v0.2.0 (*)
              │           │   │   ├── zkcast v0.2.0 (*)
              │           │   │   └── zkforge v0.2.0 (*)
              │           │   ├── foundry-test-utils v0.2.0
              │           │   │   ├── (dev) cast v0.2.0 (*)
              │           │   │   ├── (dev) forge v0.2.0 (*)
              │           │   │   ├── (dev) zkcast v0.2.0 (*)
              │           │   │   └── (dev) zkforge v0.2.0 (*)
              │           │   ├── (dev) foundry-utils v0.2.0
              │           │   │   ├── anvil v0.2.0 (*)
              │           │   │   ├── anvil-core v0.2.0 (*)
              │           │   │   ├── cast v0.2.0 (*)
              │           │   │   ├── chisel v0.2.0 (*)
              │           │   │   ├── forge v0.2.0 (*)
              │           │   │   ├── forge-doc v0.2.0
              │           │   │   │   ├── forge v0.2.0 (*)
              │           │   │   │   └── zkforge v0.2.0 (*)
              │           │   │   ├── foundry-cli v0.2.0 (*)
              │           │   │   ├── foundry-debugger v0.2.0 (*)
              │           │   │   ├── (dev) foundry-evm v0.2.0 (*)
              │           │   │   ├── foundry-test-utils v0.2.0 (*)
              │           │   │   ├── zkcast v0.2.0 (*)
              │           │   │   └── zkforge v0.2.0 (*)
              │           │   ├── zkcast v0.2.0 (*)
              │           │   └── zkforge v0.2.0 (*)
              │           └── foundry-evm v0.2.0 (*)
              └── zksync_prover_utils v0.1.0
                  ├── zksync_core v0.1.0 (*)
                  └── zksync_verification_key_generator_and_server v0.1.0
                      └── zksync_core v0.1.0 (*)
```

## Checklist

<!-- Check your PR fulfills the following items. -->
<!-- For draft PRs check the boxes as you complete them. -->

- [x] PR title corresponds to the body of PR (we generate changelog
entries from PRs).
- [ ] Tests for the changes have been added / updated.
- [ ] Documentation comments have been added / updated.
- [x] Code has been formatted via `zk fmt` and `zk lint`.
- [x] Spellcheck has been run via `cargo spellcheck
--cfg=./spellcheck/era.cfg --code 1`.

core/lib/object_store/Cargo.toml

@@ -17,8 +17,8 @@ zksync_types = { path = "../types" }
 anyhow = "1.0"
 async-trait = "0.1"
 bincode = "1"
-google-cloud-storage = "0.12.0"
-google-cloud-auth = "0.11.0"
+google-cloud-storage = "0.15.0"
+google-cloud-auth = "0.13.0"
 http = "0.2.9"
 tokio = { version = "1.21.2", features = ["full"] }
 tracing = "0.1"

deny.toml

@@ -8,7 +8,6 @@ yanked = "warn"
 notice = "warn"
 ignore = [
     "RUSTSEC-2023-0018",
-    "RUSTSEC-2023-0071"
 ]
 
 [licenses]