Fix storage deserialization bugs

[richvdh]

matrix-org/matrix-rust-sdk#4424 is a bug in deserialising crypto data from the crypto store. Creating this issue to track rolling out fixes:

• matrix-rust-sdk
  • release-for-crypto-wasm-11: Fix error loading older serialized data from storage matrix-org/matrix-rust-sdk#4430
  • release-for-crypto-wasm-12: Cherry-pick fix for #4424 onto release-for-crypto-wasm-12 matrix-org/matrix-rust-sdk#4436
  • main: matrix-org/matrix-rust-sdk@0394761
• Element Web 1.11.88 (released 2024-12-17):
  • matrix-rust-sdk: https://github.com/matrix-org/matrix-rust-sdk/tree/release-for-crypto-wasm-11
  • matrix-rust-sdk-crypto-wasm: Patched in https://github.com/matrix-org/matrix-rust-sdk-crypto-wasm/releases/tag/v11.1.0
  • matrix-js-sdk: Upgrade matrix-sdk-crypto-wasm to 1.11.0 matrix-org/matrix-js-sdk#4593, https://github.com/matrix-org/matrix-js-sdk/releases/tag/v35.1.0
  • element-web: https://github.com/element-hq/element-web/releases/tag/v1.11.89
• Element Web develop:
  • matrix-rust-sdk: https://github.com/matrix-org/matrix-rust-sdk/tree/release-for-crypto-wasm-12 (Cherry-pick fix for #4424 onto release-for-crypto-wasm-12 matrix-org/matrix-rust-sdk#4436)
  • matrix-rust-sdk-crypto-wasm: Patched in https://github.com/matrix-org/matrix-rust-sdk-crypto-wasm/releases/tag/v12.1.0
  • matrix-js-sdk: Upgrade matrix-sdk-crypto-wasm to 12.1.0 matrix-org/matrix-js-sdk#4596
• Element Android classic:
  • matrix-rust-components-kotlin https://github.com/matrix-org/matrix-rust-components-kotlin/releases/tag/crypto-v0.6.0
  • EA Bump org.matrix.rustcomponents:crypto-android from 0.5.0 to 0.6.0 element-android#8960
• Element iOS classic: not affected: no release since the bug was introduced.
• Element X Android
  • https://github.com/matrix-org/matrix-rust-components-kotlin/releases/tag/sdk-v0.2.73
  • EXA 0.7.6 https://github.com/element-hq/element-x-android/releases/tag/v0.7.6
• Element X iOS
  • https://github.com/element-hq/matrix-rust-components-swift/releases/tag/v1.0.83 (contains the fix
  • 1.9.10 EXI https://github.com/element-hq/element-x-ios/releases/tag/1.9.10 (based on 1.0.83)

[BillCarsonFr]

For the OwnUserIdentityVerifiedState state migration, we are looking for 2 different PRs that must have landed.
#3846 Introduces OwnUserIdentityVerifiedState merged Aug 16th
#4067 Renames PreviouslyVerifiedButNoLonger in VerificationViolation merged Oct 10th

Classic Android is affected because:

1.6.22 (in store Nov 5) is using sdk lib 0.4.3 (Sept 18)
and then
1.6.24 (In store Dec 2nd) is using sdk lib 0.5.0 (Oct 31)

Classic iOS not yet affected

Because #4067 has not yet landed in the sdk. Current version is 0.27.17 based on rust ffi 0.4.3 (sept 12) before the refactoring.

WebR affected

wasm bindings is affected since 10.0.0. So web is since it using a higher bindings version.
So affected since js-sdk 0.35.0
Shipped in web v1.11.88

EXA affected

EXA 0.5.12 uses component-kotlin 0.2.41 that has #3846

And EXA 0.7.1 (oct 25th) uses sdk https://github.com/matrix-org/matrix-rust-sdk/commits/31e9600078cbaa9c3119ebe79f4a8fd6860b9ce4/ that has #4067

EXI Affected

Rust-component-kotlin affected since v1.0.55 and iOS 1.8.5 released Oct 8th

[andybalaam]

Thanks @richvdh, I started to write a description like this before I realised you had done a much better job already!

[BillCarsonFr]

This is my understanding of how users can be affected:

Migration error due to OwnUserIdentityVerifiedState

In order to hit the bug, your session needs to be previously verified but not anymore.
E.g. If you reset the identity from another session and not verify it again.
Then if you are in that state, and you updated to an affected version you will hit the bug.

• On classic android it will crash due to missing handling of crypto store errors in flows.
• Web will launch, but you will see errors in the console.
  • Sending will fail because in share_room_key we try to get our own device that will load the device owner identity (via wrap_device_data) => causing the migration error.
  • Incoming messages from new contacts are UTDs? (if we have existing megolm session or existing olm channel it should be OK.
• On classic iOS?
• On android

Migration error due to VerificationLevel

Inbound group session where sender data is "From a previously verified user" will fail to load. So message will be in UTD instead of having a red shield

[BillCarsonFr]

Updated. EXA 0.7.6 and EXI 1.9.10 are released with the fix