molluskandClaude Fable 5
e78e7bc2a5
RUSTSEC-2026-0194/0195 (quick-xml 0.39.4, published 2026-06-29) broke the deny/audit CI gates on every push since June 29. quick-xml is reached only via the wayland-scanner proc-macro parsing vendored protocol XML at compile time — attacker input never touches it and it is absent from the shipped binary. The fixed 0.41.0 is semver-incompatible with wayland-scanner's `^0.39` req (no upstream bump yet); documented ignores until one exists. RUSTSEC-2026-0192 (ttf-parser unmaintained, via iced/cosmic-text) joins the existing unmaintained ignores (paste, audiopus_sys) — same class, same lockfile-pinning protection. New .cargo/audit.toml keeps cargo-audit in sync with deny.toml. Known leftover warning (allowed, non-failing): spin 0.10.0 is yanked but futures-buffered (via iroh) requires ^0.10 and no unyanked 0.10.x exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
102 lines
4.6 KiB
TOML
102 lines
4.6 KiB
TOML
# cargo-deny policy for peerspeak
|
|
#
|
|
# Supersedes a bare `cargo audit` run. Enforce with:
|
|
# cargo install cargo-deny --locked
|
|
# cargo deny check
|
|
#
|
|
# In CI, run `cargo deny check` on a locked tree so the pinned, vetted
|
|
# versions in Cargo.lock are what actually get audited.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Advisories: RustSec database. Vulnerabilities and yanked crates are denied
|
|
# by default. The two `ignore` entries below are *unmaintained* warnings only
|
|
# (no known exploit); they are deep transitive deps we cannot remove. Pinning
|
|
# them via Cargo.lock is our real protection — a future malicious release does
|
|
# not reach us until we deliberately `cargo update`, so each update is a review
|
|
# checkpoint. Revisit these if either advisory is upgraded to a vulnerability.
|
|
# ---------------------------------------------------------------------------
|
|
[advisories]
|
|
ignore = [
|
|
# paste: unmaintained, compile-time proc-macro only (zero runtime surface),
|
|
# transitive via iroh/netdev/netlink and rav1e/image/iced. Maintained fork
|
|
# `pastey` is already in the tree; stragglers will follow upstream.
|
|
"RUSTSEC-2024-0436",
|
|
# audiopus_sys: unmaintained FFI bindings to the stable libopus C library,
|
|
# pulled in via our direct `opus 0.3.1` dep. No drop-in replacement.
|
|
"RUSTSEC-2026-0150",
|
|
# ttf-parser: unmaintained, transitive via iced/cosmic-text (font parsing
|
|
# for the GUI). Inputs are system + embedded fonts, not network data. No
|
|
# upstream migration yet; revisit when iced moves off it.
|
|
"RUSTSEC-2026-0192",
|
|
# quick-xml 0.39.4 DoS advisories (quadratic dup-attr check; unbounded
|
|
# namespace allocation). Build-time only: quick-xml is reached solely via
|
|
# the wayland-scanner PROC-MACRO, which parses the wayland protocol XML
|
|
# files vendored inside the wayland-* crates at compile time. Attacker
|
|
# input never reaches it and it is not in the shipped binary. The fix
|
|
# (0.41.0) is semver-incompatible with wayland-scanner 0.31.x's `^0.39`
|
|
# requirement; drop both ignores once wayland-scanner releases a bump.
|
|
"RUSTSEC-2026-0194",
|
|
"RUSTSEC-2026-0195",
|
|
]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bans: shape of the dependency graph.
|
|
# ---------------------------------------------------------------------------
|
|
[bans]
|
|
# Multiple versions of the same crate bloat the build; warn rather than fail
|
|
# since transitive graphs (iroh, iced) routinely carry duplicates we can't fix.
|
|
multiple-versions = "warn"
|
|
# Wildcard ("*") version requirements are a supply-chain footgun: they accept
|
|
# any future release, defeating the lockfile-as-review-checkpoint model.
|
|
wildcards = "deny"
|
|
# ...but our own intra-repo path deps may use "*"; don't penalize those.
|
|
allow-wildcard-paths = true
|
|
|
|
# Crates that may never appear in the graph. Add a maintained replacement's
|
|
# predecessor here once you've migrated off it, to prevent regressions.
|
|
deny = []
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Sources: where crates are allowed to come from. This is the core anti-hijack
|
|
# control — only the official crates.io registry is trusted; arbitrary git
|
|
# sources (a common vector for slipping in unaudited code) are rejected.
|
|
# ---------------------------------------------------------------------------
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
# allow-git = [] # add a specific, pinned git repo here only if ever needed
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Licenses: permissive set covering the current graph. If `cargo deny check`
|
|
# reports an unmatched license, vet it and add the SPDX id here (or add a
|
|
# per-crate entry under [licenses.exceptions]) rather than widening blindly.
|
|
# ---------------------------------------------------------------------------
|
|
[licenses]
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"MPL-2.0",
|
|
"Unicode-3.0",
|
|
"Unicode-DFS-2016",
|
|
"CC0-1.0",
|
|
"0BSD",
|
|
"Unlicense",
|
|
"BSL-1.0",
|
|
"NCSA", # University of Illinois/NCSA — BSD-like permissive
|
|
"CDLA-Permissive-2.0", # Community Data License Agreement, permissive
|
|
]
|
|
confidence-threshold = 0.8
|
|
exceptions = []
|
|
|
|
# peerspeak is MIT-licensed (see Cargo.toml `license` + the LICENSE file) but is
|
|
# not published to crates.io, so keep the private-crate skip for the
|
|
# "unlicensed"/publish checks. MIT is already in the allow list above.
|
|
[licenses.private]
|
|
ignore = true
|