f4b09b028e
cargo update -p rustls-webpki -p tar moves rustls-webpki 0.103.9 -> 0.103.13 and tar 0.4.44 -> 0.4.46, both within the existing Cargo.toml bounds. They sit under tauri-plugin-updater, which downloads and unpacks application updates, so all six of their advisories were reachable in the shipped binary. The remaining three can neither be fixed nor reached. quick-xml (2x 7.5 high) is pulled by plist, which tauri only needs for Apple bundling: its per-target trees are empty for both shipped targets and it appears solely under x86_64-apple-darwin. Its fix is >= 0.41.0 while plist requires ^0.38, a semver-incompatible boundary [patch.crates-io] cannot cross. rsa has no published fix at all and is never compiled — its only parent is sqlx-mysql, an artifact of sqlx's multi-backend graph on a SQLite project. Leaving those three to red the daily gate forever would reproduce the signal loss that #232 removed the `|| true` to fix, so they move into a versioned .cargo/audit.toml. Entries are keyed by advisory ID, never by crate, so a new advisory against the same crate still reds the gate; each carries its reachability proof and its removal condition. A blocking step in check-rust.yml re-proves that justification on every PR touching src-tauri/ or .cargo/, and fails if a suppressed crate enters a shipped target's graph — the scenario that would rot the list is itself a src-tauri change. It separates cargo tree's exit status from its output (an absent crate and a failed invocation both print nothing) and asserts a canary crate is still found, so its silence proves something. cargo audit: 9 vulnerabilities -> 0, warnings unchanged at 23 (cargo-audit 0.22.2, advisory-db 0bfde9d6 of 2026-07-27). cargo check + cargo test green (106 tests); npm build + 871 vitest green. Resolves #310 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
3.1 KiB
TOML
65 lines
3.1 KiB
TOML
# cargo-audit configuration — accepted advisories (#310).
|
|
#
|
|
# Every ID listed here is suppressed on EVERY `cargo audit` run, including the
|
|
# daily blocking gate in .forgejo/workflows/audit.yml. So a green audit means
|
|
# "no advisory outside this list", not "no advisory at all". See
|
|
# docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
#
|
|
# Two rules govern the list:
|
|
#
|
|
# 1. An advisory may only be listed if its crate is absent from the
|
|
# dependency graph of EVERY shipped target (Windows and Linux), or if no
|
|
# fix has been published at all. A reachable advisory with an available
|
|
# fix gets fixed, never suppressed.
|
|
#
|
|
# 2. Entries are keyed by advisory ID, never by crate. A new advisory filed
|
|
# against a crate already listed here re-reds the gate on purpose — each
|
|
# one is reviewed on its own merits. Widening an entry to a whole crate
|
|
# would defeat the gate.
|
|
#
|
|
# check-rust.yml carries a guard that re-proves rule 1 on every PR touching
|
|
# src-tauri/ or this file. ADDING AN ENTRY HERE REQUIRES ADDING ITS CRATE TO
|
|
# THAT GUARD'S CRATE LIST — otherwise the new entry gets no anti-rot coverage.
|
|
#
|
|
# To re-verify an entry (or before removing one), run from the repo root:
|
|
#
|
|
# cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-unknown-linux-gnu
|
|
# cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-pc-windows-msvc
|
|
#
|
|
# Empty output on both targets means the entry is still justified. Any output
|
|
# means it is not: drop the entry and fix the advisory for real.
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# quick-xml 0.38.4 — RUSTSEC-2026-0194 (quadratic run time when checking a
|
|
# start tag for duplicate attribute names) and RUSTSEC-2026-0195 (unbounded
|
|
# namespace-declaration allocation enabling memory-exhaustion DoS), 7.5
|
|
# high each.
|
|
#
|
|
# Not compiled on either shipped target. quick-xml is pulled by `plist`,
|
|
# which tauri only depends on for Apple bundling: both per-target trees are
|
|
# empty, and it appears solely under x86_64-apple-darwin, which we do not
|
|
# ship.
|
|
#
|
|
# An override is not an option either — both advisories are patched only in
|
|
# >= 0.41.0 while plist requires ^0.38, a semver-incompatible boundary that
|
|
# `[patch.crates-io]` cannot cross.
|
|
#
|
|
# Removal trigger: plist (or tauri) shipping quick-xml >= 0.41.0 — see #312.
|
|
"RUSTSEC-2026-0194",
|
|
"RUSTSEC-2026-0195",
|
|
|
|
# rsa 0.9.10 — RUSTSEC-2023-0071 (Marvin attack: potential key recovery
|
|
# through timing side channels), 5.9 medium.
|
|
#
|
|
# Qualifies under both halves of rule 1. It has no fix at all — the
|
|
# advisory's patched list is empty, which is why suppression is the only
|
|
# option available. And it is unreachable: its sole parent in the lockfile
|
|
# is sqlx-mysql, an artifact of sqlx's multi-backend graph, while this
|
|
# project talks to SQLite through tauri-plugin-sql. `cargo tree -i rsa
|
|
# --target all` returns nothing at all.
|
|
#
|
|
# Removal trigger: a fixed rsa release, or sqlx dropping the crate from the
|
|
# graph.
|
|
"RUSTSEC-2023-0071",
|
|
]
|