# cargo-audit configuration — accepted advisories (#310).
#
# Every ID listed here is suppressed on EVERY `cargo audit` run, including the
# daily blocking gate in .forgejo/workflows/audit.yml. So a green audit means
# "no advisory outside this list", not "no advisory at all". See
# docs/adr/0018-suppression-advisories-non-atteignables.md.
#
# Two rules govern the list:
#
#   1. An advisory may only be listed if its crate is absent from the
#      dependency graph of EVERY shipped target (Windows and Linux), or if no
#      fix has been published at all. A reachable advisory with an available
#      fix gets fixed, never suppressed.
#
#   2. Entries are keyed by advisory ID, never by crate. A new advisory filed
#      against a crate already listed here re-reds the gate on purpose — each
#      one is reviewed on its own merits. Widening an entry to a whole crate
#      would defeat the gate.
#
# check-rust.yml carries a guard that re-proves rule 1 on every PR touching
# src-tauri/ or this file. ADDING AN ENTRY HERE REQUIRES ADDING ITS CRATE TO
# THAT GUARD'S CRATE LIST — otherwise the new entry gets no anti-rot coverage.
#
# To re-verify an entry (or before removing one), run from the repo root:
#
#   cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-unknown-linux-gnu
#   cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-pc-windows-msvc
#
# Empty output on both targets means the entry is still justified. Any output
# means it is not: drop the entry and fix the advisory for real.

# The quick-xml pair (RUSTSEC-2026-0194 / -0195) used to live here and was
# removed on 2026-07-27 by #312: plist 1.10.0 ships quick-xml 0.41.0, which
# carries the fix, so the advisories were resolved rather than accepted. That is
# the intended lifecycle of an entry in this file — it leaves when a fix becomes
# reachable, not when someone remembers to look.

[advisories]
ignore = [
    # rsa 0.9.10 — RUSTSEC-2023-0071 (Marvin attack: potential key recovery
    # through timing side channels), 5.9 medium.
    #
    # Qualifies under both halves of rule 1. It has no fix at all — the
    # advisory's patched list is empty, which is why suppression is the only
    # option available. And it is unreachable: its sole parent in the lockfile
    # is sqlx-mysql, an artifact of sqlx's multi-backend graph, while this
    # project talks to SQLite through tauri-plugin-sql. `cargo tree -i rsa
    # --target all` returns nothing at all.
    #
    # Removal trigger: a fixed rsa release, or sqlx dropping the crate from the
    # graph.
    "RUSTSEC-2023-0071",
]