chore(security): reconcile the hand-maintained advisory ignore lists in deny.toml and .cargo/audit.toml

未关闭
  • 哪里不对？
#464 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
44/100
Issue 类型
重构
描述清晰度
基本清楚
活跃度
活跃
技术栈
rust
领域
build-system, security

调研方向

Read .cargo/audit.toml, deny.toml, and security.yml to understand the advisory lists and feature coverage; the issue compares them at commit d9c7be0. Decide whether to document the difference or align the lists, and whether cargo deny should check the non-default TLS features. Done means the lists' relationship and the TEMP marker are resolved, with advisories tracked in both files when #340 or #386 land.

由索引模型根据 Issue 内容生成。

描述

dependencies

Problem

Accepted RustSec advisories are listed twice, by hand, with different contents and different levels of explanation:

  • .cargo/audit.toml ignores 15 advisories, most with a detailed reachability note.
  • deny.toml [advisories].ignore lists 7, with one-line comments.

In audit.toml but not in deny.toml:

  • RUSTSEC-2023-0071 (rsa, via embedded-tls)
  • RUSTSEC-2026-0387 (crypto-bigint, via embedded-tls — tracked in #340)
  • RUSTSEC-2026-0049, -0098, -0099, -0104, -0382 (rustls-webpki 0.102.8, via rumqttc)

Part of this difference is probably intentional: security.yml notes that cargo deny check sees default features only, so crates behind non-default features never reach it, while cargo audit reads the whole lockfile. But nothing in either file says so, so a reader cannot tell an intended difference from an omission. It also means cargo deny is not checking the embedded-tls / rumqttc-TLS graphs at all.

Smaller points:

  • deny.toml still tags RUSTSEC-2026-0173 as TEMP:; the same entry in audit.toml has no such marker.
  • Each entry has to be added and later removed in two places; #340 and #386 name only one of the two files.

Suggested work

  • Add a short comment at the top of each list stating why the two differ (feature coverage), or make them the same.
  • Decide whether cargo deny should also run with the non-default TLS features, the way it already does for the zenoh connector's std graph.
  • Drop or justify the TEMP marker.
  • When #340 / #386 land, remove the entries from both files.

Notes

Compared by reading the two files at d9c7be0. I did not run cargo audit or cargo deny, so I cannot say whether any listed ignore is already unnecessary.

主要语言
Rust
星标
101
派生
20
平均合并
2 小时 33 分钟
30 天内合并 PR
90

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aimdb-dev/aimdb 的其他 Issue

查看 aimdb-dev/aimdb 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。