chore(security): reconcile the hand-maintained advisory ignore lists in deny.toml and .cargo/audit.toml

Abierto
  • ¿Algo no está bien?
#464 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
44/100
Tipo de issue
Refactorización
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
build-system, security

Línea de trabajo

Read .cargo/audit.toml, deny.toml, and security.yml to understand the advisory lists and feature coverage; the issue compares them at commit d9c7be0. Decide whether to document the difference or align the lists, and whether cargo deny should check the non-default TLS features. Done means the lists' relationship and the TEMP marker are resolved, with advisories tracked in both files when #340 or #386 land.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

dependencies

Problem

Accepted RustSec advisories are listed twice, by hand, with different contents and different levels of explanation:

  • .cargo/audit.toml ignores 15 advisories, most with a detailed reachability note.
  • deny.toml [advisories].ignore lists 7, with one-line comments.

In audit.toml but not in deny.toml:

  • RUSTSEC-2023-0071 (rsa, via embedded-tls)
  • RUSTSEC-2026-0387 (crypto-bigint, via embedded-tls — tracked in #340)
  • RUSTSEC-2026-0049, -0098, -0099, -0104, -0382 (rustls-webpki 0.102.8, via rumqttc)

Part of this difference is probably intentional: security.yml notes that cargo deny check sees default features only, so crates behind non-default features never reach it, while cargo audit reads the whole lockfile. But nothing in either file says so, so a reader cannot tell an intended difference from an omission. It also means cargo deny is not checking the embedded-tls / rumqttc-TLS graphs at all.

Smaller points:

  • deny.toml still tags RUSTSEC-2026-0173 as TEMP:; the same entry in audit.toml has no such marker.
  • Each entry has to be added and later removed in two places; #340 and #386 name only one of the two files.

Suggested work

  • Add a short comment at the top of each list stating why the two differ (feature coverage), or make them the same.
  • Decide whether cargo deny should also run with the non-default TLS features, the way it already does for the zenoh connector's std graph.
  • Drop or justify the TEMP marker.
  • When #340 / #386 land, remove the entries from both files.

Notes

Compared by reading the two files at d9c7be0. I did not run cargo audit or cargo deny, so I cannot say whether any listed ignore is already unnecessary.

Lenguaje dominante
Rust
Estrellas
101
Forks
20
Merge medio
2 h 33 min
PR fusionados (30 d)
90

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aimdb-dev/aimdb

Todos los issues de aimdb-dev/aimdb

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.