From 3c601ca988c0ab45f152b4da1bcb36b6848ddb88 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 2 Aug 2026 03:14:28 +0800 Subject: [PATCH] fix(supply-chain): trust our own crates instead of exempting them ADR-0018 ranks the four cargo-vet mechanisms and states that reaching for a weaker one is a defect. These crates are ours, consumed from crates.io, so case 2 applies: a publisher-trust entry under h4x0r (user-id 347968), not an exemption. The distinction is semantic, not cosmetic. An exemption asserts "unreviewed, accepted anyway"; a trust entry asserts "the publisher is ours". Recording our own crates as unreviewed-but-tolerated misstated the supply-chain posture in the direction of false comfort. A trust entry is also version-agnostic, so it does not go stale on the next bump the way a pinned exemption does. Exemption -> trust: - blob-decoder - forensic-carve - forensicnomicon - forensicnomicon-core - forensicnomicon-data - protobuf-forensic-core Verified (config change, so the vet run is the test): Vetting Succeeded (6 fully audited, 143 exempted) WARN Your supply-chain has unnecessary exemptions which could be relaxed or pruned. WARN Consider running `cargo vet prune` to prune unnecessary exemptions and imports. Co-Authored-By: Claude Opus 5 (1M context) --- supply-chain/audits.toml | 36 +++++++++++++++++++++++++++++++++ supply-chain/config.toml | 24 ---------------------- supply-chain/imports.lock | 42 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 78 insertions(+), 24 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2772ccb..3fe9dcc 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2,3 +2,39 @@ # cargo-vet audits file [audits] + +[[trusted.blob-decoder]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-11" +end = "2027-08-01" + +[[trusted.forensic-carve]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-23" +end = "2027-08-01" + +[[trusted.forensicnomicon]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-05" +end = "2027-08-01" + +[[trusted.forensicnomicon-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-01" + +[[trusted.forensicnomicon-data]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-01" + +[[trusted.protobuf-forensic-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-11" +end = "2027-08-01" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index fb31b14..983b89c 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -77,10 +77,6 @@ criteria = "safe-to-deploy" version = "2.13.0" criteria = "safe-to-deploy" -[[exemptions.blob-decoder]] -version = "0.1.1" -criteria = "safe-to-deploy" - [[exemptions.block-buffer]] version = "0.10.4" criteria = "safe-to-deploy" @@ -217,22 +213,6 @@ criteria = "safe-to-run" version = "1.1.9" criteria = "safe-to-deploy" -[[exemptions.forensic-carve]] -version = "0.1.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon]] -version = "1.5.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-core]] -version = "1.0.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-data]] -version = "1.2.1" -criteria = "safe-to-deploy" - [[exemptions.futures-core]] version = "0.3.32" criteria = "safe-to-deploy" @@ -393,10 +373,6 @@ criteria = "safe-to-run" version = "1.0.106" criteria = "safe-to-deploy" -[[exemptions.protobuf-forensic-core]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.pxfm]] version = "0.1.29" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 27250bd..06eeba0 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,48 @@ # cargo-vet imports lock +[[publisher.blob-decoder]] +version = "0.1.1" +when = "2026-07-11" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensic-carve]] +version = "0.1.0" +when = "2026-07-23" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon]] +version = "1.5.0" +when = "2026-07-12" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-core]] +version = "1.0.0" +when = "2026-06-28" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-data]] +version = "1.2.1" +when = "2026-07-12" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.protobuf-forensic-core]] +version = "0.1.0" +when = "2026-07-11" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [audits.bytecode-alliance.audits] [audits.embark.audits]