chore(security): reconcile the hand-maintained advisory ignore lists in deny.toml and .cargo/audit.toml

Aperta
  • Qualcosa non va?
#464 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
44/100
Tipo di issue
Refactoring
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
build-system, security

Direzione di ricerca

Read .cargo/audit.toml, deny.toml, and security.yml to understand the advisory lists and feature coverage; the issue compares them at commit d9c7be0. Decide whether to document the difference or align the lists, and whether cargo deny should check the non-default TLS features. Done means the lists' relationship and the TEMP marker are resolved, with advisories tracked in both files when #340 or #386 land.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

dependencies

Problem

Accepted RustSec advisories are listed twice, by hand, with different contents and different levels of explanation:

  • .cargo/audit.toml ignores 15 advisories, most with a detailed reachability note.
  • deny.toml [advisories].ignore lists 7, with one-line comments.

In audit.toml but not in deny.toml:

  • RUSTSEC-2023-0071 (rsa, via embedded-tls)
  • RUSTSEC-2026-0387 (crypto-bigint, via embedded-tls — tracked in #340)
  • RUSTSEC-2026-0049, -0098, -0099, -0104, -0382 (rustls-webpki 0.102.8, via rumqttc)

Part of this difference is probably intentional: security.yml notes that cargo deny check sees default features only, so crates behind non-default features never reach it, while cargo audit reads the whole lockfile. But nothing in either file says so, so a reader cannot tell an intended difference from an omission. It also means cargo deny is not checking the embedded-tls / rumqttc-TLS graphs at all.

Smaller points:

  • deny.toml still tags RUSTSEC-2026-0173 as TEMP:; the same entry in audit.toml has no such marker.
  • Each entry has to be added and later removed in two places; #340 and #386 name only one of the two files.

Suggested work

  • Add a short comment at the top of each list stating why the two differ (feature coverage), or make them the same.
  • Decide whether cargo deny should also run with the non-default TLS features, the way it already does for the zenoh connector's std graph.
  • Drop or justify the TEMP marker.
  • When #340 / #386 land, remove the entries from both files.

Notes

Compared by reading the two files at d9c7be0. I did not run cargo audit or cargo deny, so I cannot say whether any listed ignore is already unnecessary.

Lingua principale
Rust
Stelle
101
Fork
20
Merge medio
2h 33m
PR unite (30g)
90

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aimdb-dev/aimdb

Tutte le issue di aimdb-dev/aimdb

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.