build(connector)!: update sspi to 0.23 and picky to rc.26

[Suresh Kumar Ramu (sureshkumarramu)]

sspi 0.21 and picky 7.0.0-rc.25 pin pre-release ed25519-dalek / curve25519-dalek. Cargo treats a pre-release and the stable release of the same major as one slot, so a dependency graph that already contains the stable crates cannot resolve ironrdp-connector at all. sspi 0.23 pins no dalek crate and picky rc.26 uses the stable ones.

TsRequest::buffer_len is fallible in sspi 0.23; the connector and the acceptor map its error like the encode step beside it. sspi is re-exported by the connector, so this is a breaking dependency change for consumers of its sspi types, and the manifest line now carries the public marker.

picky-krb is held at 0.12.4 in the lockfile because sspi 0.23.0 does not build against 0.12.5, published after it.

BREAKING CHANGE: ironrdp_connector::sspi is now sspi 0.23.

Issue: #1363
Co-authored-by: Claude Fable 5.1 noreply@anthropic.com

[Suresh Kumar Ramu (sureshkumarramu)]

The public API compatibility check fails inside sspi 0.23.0 itself, not in this change: the check resolves in a fresh workspace and takes picky-krb 0.12.5, which added GssApiMessageError::InvalidMechanismOid after sspi 0.23.0 was published. sspi-rs master handles the variant since 878be568 (#764), so the check should pass once the next sspi release is on crates.io. The workspace Cargo.lock here holds picky-krb at 0.12.4 for the same reason.

Verified locally on this branch: cargo fmt --check, cargo clippy --locked -D warnings on ironrdp-connector, ironrdp-acceptor and ffi, cargo check --locked -p ironrdp-mstsgu --features rustls,smartcard, and cargo test --locked -p ironrdp-testsuite-core (1727 passed).

Note

Human-tuned, LLM-assisted content.

[Benoît Cortier (CBenoit)]

PR automation is failing because of a picky-krb 0.12.5 incompatibility, fixed on master by #2074. Please rebase on master to fix it.

[Suresh Kumar Ramu (sureshkumarramu)]

Rebased on master (838cc42). The public-API check now fails before comparing anything: error: unsupported rustdoc format v61 from cargo-semver-checks 0.49.0, the same on every open PR today, so it looks like the pinned tool is behind the runner's toolchain rather than anything in this change.

[Benoît Cortier (CBenoit)]

I think this should fix that one: #2088

[Suresh Kumar Ramu (sureshkumarramu)]

Rebased on master again (40902b4) after #2087 and #2088 landed; all checks pass now. Since picky-krb 0.12.5 is yanked and a fresh resolve takes 0.12.4, the lockfile no longer needs the pin and the commit message dropped that paragraph. Nothing else changed; ready for review.

[Benoît Cortier (CBenoit)]

LGTM, thank you!

[Suresh Kumar Ramu (sureshkumarramu)]

Windows CI failure: cause and fix

What failed: Checks [windows] stopped compiling ironrdp-vmconnect:

error[E0277]: the trait bound `usize: From<Result<u16, ironrdp_connector::sspi::Error>>` is not satisfied
  --> crates\ironrdp-vmconnect\src\native_credssp.rs:55:46

Cause: in sspi 0.23, TsRequest::buffer_len() returns Result<u16> instead of u16. This PR updated the two callers in ironrdp-connector and ironrdp-acceptor. It missed the third, in ironrdp-vmconnect's native CredSSP path, which only builds on Windows. I verified on Linux only, so that code was never compiled.

Fix (d90284f): one call site, handled the same way as the other two:

let mut encoded = Vec::with_capacity(usize::from(
    outgoing
        .buffer_len()
        .map_err(|error| custom_err!("native CredSSP request length", error))?,
));

A search for buffer_len() across crates/ and ffi/ finds no other caller left on the old signature.

Verified, cross-compiling for Windows (x86_64-pc-windows-gnu, toolchain 1.94.1 from rust-toolchain.toml):

• cargo check --locked -p ironrdp-vmconnect: fails with the error above before the fix, and passes after it.
• cargo clippy --locked -p ironrdp-vmconnect -- -D warnings: passes.
• cargo fmt -p ironrdp-vmconnect -- --check: clean.

A correction: my earlier "all checks pass" was premature. The main CI run was still waiting for workflow approval, and only the automation checks had run. Sorry for the extra round.

The fix is pushed as a separate commit so the change is easy to see. I'm happy to squash it into the first commit if you prefer one.

[github-actions]

🟢 Dependency upgrade (sspi 0.21->0.23, picky 7.0.0-rc.25->rc.26) with minimal code adaptation: three TsRequest::buffer_len() call sites (ironrdp-connector, ironrdp-acceptor, ironrdp-vmconnect) updated to handle the now-fallible sspi 0.23 signature by propagating an error via custom_err!, matching the adjacent encode_ts_request handling. Independently verified: all three call sites are the complete set of TsRequest::buffer_len() callers (the Windows-only vmconnect site fixed in d90284f included); custom_err! is in scope in all three files; no other sspi callers remain (acceptor lib.rs:200 uses the unrelated infallible EarlyUserAuthResult::buffer_len); the '# public' marker is correctly placed only on the connector, which re-exports sspi, while mstsgu, ironrdp, and ffi keep sspi private; lockfile transitions (pre-release dalek/ec crates to stable) are consistent with the upgrade and picky-krb is held at 0.12.4 consistent with the yanked 0.12.5. No PDU fields, constants, sequencing, or sec…