3 Commits

Include renames

Author	SHA1	Message	Date
molluskandClaude Fable 5	e78e7bc2a5	supply-chain: ignore quick-xml build-time DoS advisories + ttf-parser unmaintained ... RUSTSEC-2026-0194/0195 (quick-xml 0.39.4, published 2026-06-29) broke the deny/audit CI gates on every push since June 29. quick-xml is reached only via the wayland-scanner proc-macro parsing vendored protocol XML at compile time — attacker input never touches it and it is absent from the shipped binary. The fixed 0.41.0 is semver-incompatible with wayland-scanner's `^0.39` req (no upstream bump yet); documented ignores until one exists. RUSTSEC-2026-0192 (ttf-parser unmaintained, via iced/cosmic-text) joins the existing unmaintained ignores (paste, audiopus_sys) — same class, same lockfile-pinning protection. New .cargo/audit.toml keeps cargo-audit in sync with deny.toml. Known leftover warning (allowed, non-failing): spin 0.10.0 is yanked but futures-buffered (via iroh) requires ^0.10 and no unyanked 0.10.x exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-16 23:46:13 -04:00
molluskandClaude Opus 4.8	47be7c340d	license: adopt MIT for the application + add THIRD_PARTY_LICENSES ... Set license = "MIT" (Cargo.toml), add the MIT LICENSE file, and switch the PKGBUILD to license=('MIT'). Generate a THIRD_PARTY_LICENSES file enumerating the full dependency-graph manifest plus the canonical text of every referenced license, with notices for the statically-bundled Opus codec and the embedded fonts (Iced-Icons, Cantarell/OFL-1.1). Ship both files in the .deb and Arch packages. Update README License section and stale private-build metadata. Codex (gpt-5.5) audited the tree and confirmed no copyleft blocks MIT; the remaining items were asset provenance + binary-distribution notice hygiene, which THIRD_PARTY_LICENSES addresses. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 15:24:43 -04:00
molluskandClaude Opus 4.8	465c7ba2b0	Add cargo-deny supply-chain policy (deny.toml) ... Supersede bare cargo-audit with an enforceable four-part policy, validated against the current tree with cargo-deny 0.19.9 (advisories/bans/licenses/ sources all pass): - advisories: deny vulnerabilities + yanked; ignore the two *unmaintained* warnings (paste RUSTSEC-2024-0436, audiopus_sys RUSTSEC-2026-0150) with rationale. Both are transitive and pinned via Cargo.lock, so a future malicious release can't reach us until a deliberate cargo update. - sources: trust only crates.io; deny unknown registries and git sources (core anti-hijack control). - bans: deny wildcard version reqs; warn on duplicate versions. - licenses: permissive allow-list covering the current graph. Mark peerspeak publish = false (it's an application, not a published library): blocks accidental cargo publish and lets [licenses.private] skip the missing-license check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-18 15:46:52 -04:00