2d4caecae8
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 9m23s
The removal trigger #312 was written for had already fired — I filed the issue without checking whether a newer plist existed. plist 1.10.0 ships quick-xml 0.41.0, which carries the fix, within tauri's existing bound: cargo update -p plist -> plist 1.8.0 -> 1.10.0 quick-xml 0.38.4 -> 0.41.0 So RUSTSEC-2026-0194 and -0195 are resolved rather than accepted, and leave .cargo/audit.toml the day they entered it. rsa is now the only entry, and the guard loops on that crate alone; its rationale comment is re-pointed accordingly, since it was written entirely around quick-xml/plist. Also bumps the two yanked crates (#313). tauri-plugin-deep-link 2.4.8 -> 2.4.9: upstream's 2.4.9 is a single commit, "Fix broken iOS custom URL schemes", so the defect behind the yank is iOS-only and never reached this desktop app — v0.14.0 shipping 2.4.8 was not a user-facing problem, which is why neither Security nor Fixed applies to it in the changelog. spin 0.9.8 -> 0.9.9; every 0.9.x up to 0.9.8 is yanked, which reads as a bulk yank rather than a defect. The #310 changelog bullet is amended rather than contradicted: it sits in the same unreleased section and would otherwise ship two opposing claims in the same release notes. Two of its statements were wrong. It said three advisories remained (now one), and it said tar sits on "real code paths in the shipped app" — tar is compiled, but its vulnerable extraction path is only reached by the AppImage and macOS installers this project does not bundle. The rustls-webpki half stands: TLS runs on every update check. ADR 0018's decision is untouched; an amendment header marks the passages that are now historical, including the "override is impossible" alternative, which plist 1.10.0 made false the same day. cargo audit from the repo root: 0 vulnerabilities, warnings 23 -> 21 (the two yanked ones). From src-tauri/ it reports 1 — that is the cwd sensitivity of .cargo/audit.toml, not a regression. Guard: 2 checks + canary, exit 0. cargo check + cargo test green (106 tests). Lock diff: 4 packages, 666 before and after. Resolves #312 Resolves #313 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
2.6 KiB
TOML
53 lines
2.6 KiB
TOML
# cargo-audit configuration — accepted advisories (#310).
|
|
#
|
|
# Every ID listed here is suppressed on EVERY `cargo audit` run, including the
|
|
# daily blocking gate in .forgejo/workflows/audit.yml. So a green audit means
|
|
# "no advisory outside this list", not "no advisory at all". See
|
|
# docs/adr/0018-suppression-advisories-non-atteignables.md.
|
|
#
|
|
# Two rules govern the list:
|
|
#
|
|
# 1. An advisory may only be listed if its crate is absent from the
|
|
# dependency graph of EVERY shipped target (Windows and Linux), or if no
|
|
# fix has been published at all. A reachable advisory with an available
|
|
# fix gets fixed, never suppressed.
|
|
#
|
|
# 2. Entries are keyed by advisory ID, never by crate. A new advisory filed
|
|
# against a crate already listed here re-reds the gate on purpose — each
|
|
# one is reviewed on its own merits. Widening an entry to a whole crate
|
|
# would defeat the gate.
|
|
#
|
|
# check-rust.yml carries a guard that re-proves rule 1 on every PR touching
|
|
# src-tauri/ or this file. ADDING AN ENTRY HERE REQUIRES ADDING ITS CRATE TO
|
|
# THAT GUARD'S CRATE LIST — otherwise the new entry gets no anti-rot coverage.
|
|
#
|
|
# To re-verify an entry (or before removing one), run from the repo root:
|
|
#
|
|
# cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-unknown-linux-gnu
|
|
# cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-pc-windows-msvc
|
|
#
|
|
# Empty output on both targets means the entry is still justified. Any output
|
|
# means it is not: drop the entry and fix the advisory for real.
|
|
|
|
# The quick-xml pair (RUSTSEC-2026-0194 / -0195) used to live here and was
|
|
# removed on 2026-07-27 by #312: plist 1.10.0 ships quick-xml 0.41.0, which
|
|
# carries the fix, so the advisories were resolved rather than accepted. That is
|
|
# the intended lifecycle of an entry in this file — it leaves when a fix becomes
|
|
# reachable, not when someone remembers to look.
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# rsa 0.9.10 — RUSTSEC-2023-0071 (Marvin attack: potential key recovery
|
|
# through timing side channels), 5.9 medium.
|
|
#
|
|
# Qualifies under both halves of rule 1. It has no fix at all — the
|
|
# advisory's patched list is empty, which is why suppression is the only
|
|
# option available. And it is unreachable: its sole parent in the lockfile
|
|
# is sqlx-mysql, an artifact of sqlx's multi-backend graph, while this
|
|
# project talks to SQLite through tauri-plugin-sql. `cargo tree -i rsa
|
|
# --target all` returns nothing at all.
|
|
#
|
|
# Removal trigger: a fixed rsa release, or sqlx dropping the crate from the
|
|
# graph.
|
|
"RUSTSEC-2023-0071",
|
|
]
|