Skip to content

Commit cfd4eef

Browse files
sdbondisdbondi
committed
add all supply chain audit excemptions
1 parent 6e71b0d commit cfd4eef

File tree

2 files changed

+126
-51
lines changed

2 files changed

+126
-51
lines changed

‎supply-chain/config.toml‎

Lines changed: 40 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
# cargo-vet config file
23

34
[cargo-vet]
@@ -382,18 +383,6 @@ criteria = "safe-to-deploy"
382383
version = "0.4.39"
383384
criteria = "safe-to-deploy"
384385

385-
[[exemptions.ciborium]]
386-
version = "0.2.2"
387-
criteria = "safe-to-run"
388-
389-
[[exemptions.ciborium-io]]
390-
version = "0.2.2"
391-
criteria = "safe-to-run"
392-
393-
[[exemptions.ciborium-ll]]
394-
version = "0.2.2"
395-
criteria = "safe-to-run"
396-
397386
[[exemptions.cidr]]
398387
version = "0.1.1"
399388
criteria = "safe-to-deploy"
@@ -834,6 +823,10 @@ criteria = "safe-to-run"
834823
version = "0.3.31"
835824
criteria = "safe-to-deploy"
836825

826+
[[exemptions.generator]]
827+
version = "0.8.4"
828+
criteria = "safe-to-deploy"
829+
837830
[[exemptions.generic-array]]
838831
version = "0.14.7"
839832
criteria = "safe-to-deploy"
@@ -882,10 +875,6 @@ criteria = "safe-to-deploy"
882875
version = "0.4.7"
883876
criteria = "safe-to-deploy"
884877

885-
[[exemptions.half]]
886-
version = "2.4.1"
887-
criteria = "safe-to-run"
888-
889878
[[exemptions.hashbrown]]
890879
version = "0.14.5"
891880
criteria = "safe-to-deploy"
@@ -1194,8 +1183,8 @@ criteria = "safe-to-deploy"
11941183
version = "1.3.0"
11951184
criteria = "safe-to-deploy"
11961185

1197-
[[exemptions.lru-cache]]
1198-
version = "0.1.2"
1186+
[[exemptions.loom]]
1187+
version = "0.7.2"
11991188
criteria = "safe-to-deploy"
12001189

12011190
[[exemptions.mac]]
@@ -1290,6 +1279,10 @@ criteria = "safe-to-deploy"
12901279
version = "1.0.3"
12911280
criteria = "safe-to-deploy"
12921281

1282+
[[exemptions.moka]]
1283+
version = "0.12.10"
1284+
criteria = "safe-to-deploy"
1285+
12931286
[[exemptions.monero]]
12941287
version = "0.21.0"
12951288
criteria = "safe-to-deploy"
@@ -1678,10 +1671,6 @@ criteria = "safe-to-deploy"
16781671
version = "0.2.1"
16791672
criteria = "safe-to-deploy"
16801673

1681-
[[exemptions.rand]]
1682-
version = "0.8.5"
1683-
criteria = "safe-to-deploy"
1684-
16851674
[[exemptions.rand_core]]
16861675
version = "0.5.1"
16871676
criteria = "safe-to-deploy"
@@ -2026,6 +2015,10 @@ criteria = "safe-to-deploy"
20262015
version = "0.5.0"
20272016
criteria = "safe-to-deploy"
20282017

2018+
[[exemptions.tagptr]]
2019+
version = "0.2.0"
2020+
criteria = "safe-to-deploy"
2021+
20292022
[[exemptions.tari-tiny-keccak]]
20302023
version = "2.0.2"
20312024
criteria = "safe-to-deploy"
@@ -2142,18 +2135,10 @@ criteria = "safe-to-deploy"
21422135
version = "0.11.0"
21432136
criteria = "safe-to-deploy"
21442137

2145-
[[exemptions.thiserror]]
2146-
version = "1.0.69"
2147-
criteria = "safe-to-deploy"
2148-
21492138
[[exemptions.thiserror]]
21502139
version = "2.0.6"
21512140
criteria = "safe-to-deploy"
21522141

2153-
[[exemptions.thiserror-impl]]
2154-
version = "1.0.69"
2155-
criteria = "safe-to-deploy"
2156-
21572142
[[exemptions.thiserror-impl]]
21582143
version = "2.0.6"
21592144
criteria = "safe-to-deploy"
@@ -2270,6 +2255,10 @@ criteria = "safe-to-deploy"
22702255
version = "0.1.33"
22712256
criteria = "safe-to-deploy"
22722257

2258+
[[exemptions.tracing-log]]
2259+
version = "0.2.0"
2260+
criteria = "safe-to-deploy"
2261+
22732262
[[exemptions.tracing-subscriber]]
22742263
version = "0.3.19"
22752264
criteria = "safe-to-deploy"
@@ -2310,10 +2299,6 @@ criteria = "safe-to-deploy"
23102299
version = "2.8.0"
23112300
criteria = "safe-to-deploy"
23122301

2313-
[[exemptions.unicode-bidi]]
2314-
version = "0.3.17"
2315-
criteria = "safe-to-deploy"
2316-
23172302
[[exemptions.unsafe-any-ors]]
23182303
version = "1.0.0"
23192304
criteria = "safe-to-deploy"
@@ -2426,8 +2411,28 @@ criteria = "safe-to-deploy"
24262411
version = "0.4.0"
24272412
criteria = "safe-to-deploy"
24282413

2414+
[[exemptions.windows]]
2415+
version = "0.58.0"
2416+
criteria = "safe-to-deploy"
2417+
24292418
[[exemptions.windows-core]]
2430-
version = "0.52.0"
2419+
version = "0.58.0"
2420+
criteria = "safe-to-deploy"
2421+
2422+
[[exemptions.windows-implement]]
2423+
version = "0.58.0"
2424+
criteria = "safe-to-deploy"
2425+
2426+
[[exemptions.windows-interface]]
2427+
version = "0.58.0"
2428+
criteria = "safe-to-deploy"
2429+
2430+
[[exemptions.windows-result]]
2431+
version = "0.2.0"
2432+
criteria = "safe-to-deploy"
2433+
2434+
[[exemptions.windows-strings]]
2435+
version = "0.1.0"
24312436
criteria = "safe-to-deploy"
24322437

24332438
[[exemptions.windows-sys]]

‎supply-chain/imports.lock‎

Lines changed: 86 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,6 @@ user-id = 4484
2929
user-login = "hsivonen"
3030
user-name = "Henri Sivonen"
3131

32-
[[publisher.unicode-normalization]]
33-
version = "0.1.24"
34-
when = "2024-09-17"
35-
user-id = 1139
36-
user-login = "Manishearth"
37-
user-name = "Manish Goregaokar"
38-
3932
[[publisher.unicode-segmentation]]
4033
version = "1.12.0"
4134
when = "2024-09-13"
@@ -302,12 +295,24 @@ who = "Pat Hickey <phickey@fastly.com>"
302295
criteria = "safe-to-deploy"
303296
version = "0.1.0"
304297

298+
[[audits.bytecode-alliance.audits.nu-ansi-term]]
299+
who = "Pat Hickey <phickey@fastly.com>"
300+
criteria = "safe-to-deploy"
301+
version = "0.46.0"
302+
notes = "one use of unsafe to call windows specific api to get console handle."
303+
305304
[[audits.bytecode-alliance.audits.openssl-probe]]
306305
who = "Pat Hickey <phickey@fastly.com>"
307306
criteria = "safe-to-deploy"
308307
version = "0.1.5"
309308
notes = "IO is only checking for the existence of paths in the filesystem"
310309

310+
[[audits.bytecode-alliance.audits.overload]]
311+
who = "Pat Hickey <phickey@fastly.com>"
312+
criteria = "safe-to-deploy"
313+
version = "0.1.1"
314+
notes = "small crate, only defines macro-rules!, nicely documented as well"
315+
311316
[[audits.bytecode-alliance.audits.percent-encoding]]
312317
who = "Alex Crichton <alex@alexcrichton.com>"
313318
criteria = "safe-to-deploy"
@@ -434,6 +439,18 @@ criteria = "safe-to-deploy"
434439
version = "1.0.1"
435440
notes = "No unsafe usage or ambient capabilities"
436441

442+
[[audits.embark-studios.audits.thiserror]]
443+
who = "Johan Andersson <opensource@embark-studios.com>"
444+
criteria = "safe-to-deploy"
445+
version = "1.0.40"
446+
notes = "Wrapper over implementation crate, found no unsafe or ambient capabilities used"
447+
448+
[[audits.embark-studios.audits.thiserror-impl]]
449+
who = "Johan Andersson <opensource@embark-studios.com>"
450+
criteria = "safe-to-deploy"
451+
version = "1.0.40"
452+
notes = "Found no unsafe or ambient capabilities used"
453+
437454
[[audits.embark-studios.audits.valuable]]
438455
who = "Johan Andersson <opensource@embark-studios.com>"
439456
criteria = "safe-to-deploy"
@@ -620,6 +637,24 @@ criteria = "safe-to-deploy"
620637
version = "1.0.0"
621638
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
622639

640+
[[audits.google.audits.ciborium]]
641+
who = "Daniel Verkamp <dverkamp@chromium.org>"
642+
criteria = "safe-to-run"
643+
version = "0.2.2"
644+
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
645+
646+
[[audits.google.audits.ciborium-io]]
647+
who = "Daniel Verkamp <dverkamp@chromium.org>"
648+
criteria = "safe-to-run"
649+
version = "0.2.2"
650+
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
651+
652+
[[audits.google.audits.ciborium-ll]]
653+
who = "Daniel Verkamp <dverkamp@chromium.org>"
654+
criteria = "safe-to-run"
655+
version = "0.2.2"
656+
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
657+
623658
[[audits.google.audits.color_quant]]
624659
who = "George Burgess IV <gbiv@google.com>"
625660
criteria = "safe-to-deploy"
@@ -770,6 +805,12 @@ delta = "1.0.34 -> 1.0.35"
770805
notes = "There are no significant code changes in this delta (just one string constant change). Note that prior audits may have been partial."
771806
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
772807

808+
[[audits.google.audits.half]]
809+
who = "Daniel Verkamp <dverkamp@chromium.org>"
810+
criteria = "safe-to-run"
811+
version = "2.4.1"
812+
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
813+
773814
[[audits.google.audits.heck]]
774815
who = "Lukasz Anforowicz <lukasza@chromium.org>"
775816
criteria = "safe-to-deploy"
@@ -1084,6 +1125,15 @@ The delta just 1) inlines/expands `impl ToTokens` that used to be handled via
10841125
"""
10851126
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
10861127

1128+
[[audits.google.audits.rand]]
1129+
who = "Lukasz Anforowicz <lukasza@chromium.org>"
1130+
criteria = "safe-to-deploy"
1131+
version = "0.8.5"
1132+
notes = """
1133+
For more detailed unsafe review notes please see https://crrev.com/c/6362797
1134+
"""
1135+
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1136+
10871137
[[audits.google.audits.regex-syntax]]
10881138
who = "Manish Goregaokar <manishearth@google.com>"
10891139
criteria = "safe-to-deploy"
@@ -1459,6 +1509,13 @@ delta = "1.0.13 -> 1.0.14"
14591509
notes = "Minimal delta in `.rs` files: new test assertions + doc changes."
14601510
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
14611511

1512+
[[audits.google.audits.windows-core]]
1513+
who = "Manish Goregaokar <manishearth@google.com>"
1514+
criteria = "safe-to-deploy"
1515+
version = "0.52.0"
1516+
notes = "Implements Windows system APIs"
1517+
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1518+
14621519
[[audits.google.audits.yoke]]
14631520
who = "Manish Goregaokar <manishearth@google.com>"
14641521
criteria = "safe-to-deploy"
@@ -1696,6 +1753,16 @@ who = "David Cook <dcook@divviup.org>"
16961753
criteria = "safe-to-deploy"
16971754
delta = "2.5.0 -> 2.6.1"
16981755

1756+
[[audits.isrg.audits.thiserror]]
1757+
who = "Brandon Pitman <bran@bran.land>"
1758+
criteria = "safe-to-deploy"
1759+
delta = "1.0.40 -> 1.0.43"
1760+
1761+
[[audits.isrg.audits.thiserror-impl]]
1762+
who = "Brandon Pitman <bran@bran.land>"
1763+
criteria = "safe-to-deploy"
1764+
delta = "1.0.40 -> 1.0.43"
1765+
16991766
[[audits.isrg.audits.universal-hash]]
17001767
who = "David Cook <dcook@divviup.org>"
17011768
criteria = "safe-to-deploy"
@@ -1735,15 +1802,6 @@ end = "2025-10-23"
17351802
notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
17361803
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
17371804

1738-
[[audits.mozilla.wildcard-audits.unicode-normalization]]
1739-
who = "Manish Goregaokar <manishsmail@gmail.com>"
1740-
criteria = "safe-to-deploy"
1741-
user-id = 1139 # Manish Goregaokar (Manishearth)
1742-
start = "2019-11-06"
1743-
end = "2026-02-01"
1744-
notes = "All code written or reviewed by Manish"
1745-
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
1746-
17471805
[[audits.mozilla.wildcard-audits.unicode-segmentation]]
17481806
who = "Manish Goregaokar <manishsmail@gmail.com>"
17491807
criteria = "safe-to-deploy"
@@ -2405,6 +2463,18 @@ criteria = "safe-to-deploy"
24052463
delta = "0.16.0 -> 0.16.1"
24062464
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
24072465

2466+
[[audits.mozilla.audits.thiserror]]
2467+
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
2468+
criteria = "safe-to-deploy"
2469+
delta = "1.0.43 -> 1.0.69"
2470+
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
2471+
2472+
[[audits.mozilla.audits.thiserror-impl]]
2473+
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
2474+
criteria = "safe-to-deploy"
2475+
delta = "1.0.43 -> 1.0.69"
2476+
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
2477+
24082478
[[audits.mozilla.audits.time-core]]
24092479
who = "Kershaw Chang <kershaw@mozilla.com>"
24102480
criteria = "safe-to-deploy"

0 commit comments

Comments
 (0)
⚡