diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 89c1129..6371656 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,44 +6,33 @@ on: pull_request: branches: [main] +permissions: + contents: read + +# Retained for the repo-specific jobs BELOW `ci:` only — a called workflow does +# not inherit the caller's `env:`, so this block governs nothing in `ci:`. The +# old ci.yml ran the coverage/package/geiger jobs under `-D warnings`; dropping +# it here would quietly relax them. env: CARGO_TERM_COLOR: always RUSTFLAGS: -D warnings jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt - - run: cargo fmt --check + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3 + with: + # The old coverage job gated on FUNCTIONS (`--fail-under-functions 100`), + # which no input here can express — a line gate is a different assertion, + # and inheriting the `strict` default would impose a 100%-LINE gate this + # repo has never met (measured 97.02% lines / 100% functions). The original + # job is preserved verbatim below; turning the shared one off keeps it the + # single coverage gate, exactly as before. + coverage-gate: "off" - clippy: - name: Clippy - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo clippy --all-targets --all-features -- -D warnings - - test: - name: Test (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test # default features - - run: cargo test --all-features # serde JSON output + # --------------------------------------------------------------------------- + # Copied VERBATIM from the pre-adoption ci.yml. Each expresses something the + # shared workflow has no input for. + # --------------------------------------------------------------------------- coverage: name: Coverage @@ -62,36 +51,6 @@ jobs: # the function gate is the meaningful invariant. - run: cargo llvm-cov --all-features --fail-under-functions 100 --show-missing-lines - msrv: - name: MSRV (1.96) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.96.0 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test --all-features - - # The published libraries promise a LOW MSRV (a crates.io compatibility signal), - # distinct from the dev toolchain pin and the app's MSRV above. Build ONLY the - # libs against the floor; the CLI app legitimately requires the newer toolchain. - msrv-libs: - name: Library MSRV (1.80) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.80.0 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo build -p sqlite-core -p sqlite-forensic --all-features - - deny: - name: cargo-deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@v2 # renovate: pin digest - with: - command: check - # crates.io only gates description + license fields, not the README/LICENSE # files — assert every publishable crate actually packages both. package: @@ -112,35 +71,6 @@ jobs: echo "✓ $p packages README.md + LICENSE" done - fuzz-check: - name: Fuzz targets compile (nightly) - runs-on: ubuntu-latest - # cargo-fuzz builds with the host nightly; warnings in its own deps must not - # fail the install, so this job does not deny warnings. - env: - RUSTFLAGS: "" - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@nightly - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo install cargo-fuzz - - run: cargo +nightly fuzz check - - secrets: - name: Secret Scan (gitleaks) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: Install gitleaks - run: | - VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name[1:]') - curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar xz -C /tmp gitleaks - - name: Run gitleaks - run: /tmp/gitleaks detect --source . - geiger: name: Unsafe Audit (cargo-geiger) runs-on: ubuntu-latest @@ -151,12 +81,3 @@ jobs: - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - run: cargo install cargo-geiger --locked - run: cargo geiger 2>&1 || true - - docs: - name: Docs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 3fe9dcc..596ed9d 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -9,32 +9,68 @@ user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-11" end = "2027-08-01" +[[trusted.ewf]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-03-05" +end = "2027-08-07" + [[trusted.forensic-carve]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-23" end = "2027-08-01" +[[trusted.forensic-vfs]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-07" +end = "2027-08-07" + [[trusted.forensicnomicon]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-05" -end = "2027-08-01" +end = "2027-08-07" [[trusted.forensicnomicon-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-01" +end = "2027-08-07" [[trusted.forensicnomicon-data]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-01" +end = "2027-08-07" + +[[trusted.jsonguard]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-05-21" +end = "2027-08-07" [[trusted.protobuf-forensic-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-11" end = "2027-08-01" + +[[trusted.safe-decode]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-08-02" +end = "2027-08-07" + +[[trusted.safe-read]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-15" +end = "2027-08-07" + +[[trusted.state-history-forensic]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-16" +end = "2027-08-07" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 983b89c..b4b58c5 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -25,10 +25,6 @@ audit-as-crates-io = false [policy.sqlite4n6] audit-as-crates-io = false -[[exemptions.adler2]] -version = "2.0.1" -criteria = "safe-to-deploy" - [[exemptions.aes]] version = "0.8.4" criteria = "safe-to-run" @@ -57,10 +53,6 @@ criteria = "safe-to-deploy" version = "3.0.11" criteria = "safe-to-deploy" -[[exemptions.arbitrary]] -version = "1.4.2" -criteria = "safe-to-run" - [[exemptions.atoi_simd]] version = "0.17.0" criteria = "safe-to-run" @@ -69,10 +61,6 @@ criteria = "safe-to-run" version = "1.5.1" criteria = "safe-to-deploy" -[[exemptions.base64]] -version = "0.22.1" -criteria = "safe-to-deploy" - [[exemptions.bitflags]] version = "2.13.0" criteria = "safe-to-deploy" @@ -81,18 +69,10 @@ criteria = "safe-to-deploy" version = "0.10.4" criteria = "safe-to-deploy" -[[exemptions.bumpalo]] -version = "3.20.3" -criteria = "safe-to-deploy" - [[exemptions.bytemuck]] version = "1.25.0" criteria = "safe-to-deploy" -[[exemptions.byteorder]] -version = "1.5.0" -criteria = "safe-to-run" - [[exemptions.byteorder-lite]] version = "0.1.0" criteria = "safe-to-deploy" @@ -113,10 +93,6 @@ criteria = "safe-to-run" version = "1.0.4" criteria = "safe-to-deploy" -[[exemptions.cipher]] -version = "0.4.4" -criteria = "safe-to-run" - [[exemptions.clap]] version = "4.6.1" criteria = "safe-to-deploy" @@ -137,10 +113,6 @@ criteria = "safe-to-deploy" version = "0.1.2" criteria = "safe-to-run" -[[exemptions.color_quant]] -version = "1.1.0" -criteria = "safe-to-deploy" - [[exemptions.colorchoice]] version = "1.0.5" criteria = "safe-to-deploy" @@ -173,26 +145,10 @@ criteria = "safe-to-run" version = "0.1.12" criteria = "safe-to-run" -[[exemptions.deranged]] -version = "0.5.8" -criteria = "safe-to-deploy" - -[[exemptions.derive_arbitrary]] -version = "1.4.2" -criteria = "safe-to-run" - [[exemptions.digest]] version = "0.10.7" criteria = "safe-to-deploy" -[[exemptions.encoding_rs]] -version = "0.8.35" -criteria = "safe-to-run" - -[[exemptions.equivalent]] -version = "1.0.2" -criteria = "safe-to-deploy" - [[exemptions.fast-float2]] version = "0.2.3" criteria = "safe-to-run" @@ -201,10 +157,6 @@ criteria = "safe-to-run" version = "0.2.7" criteria = "safe-to-deploy" -[[exemptions.fdeflate]] -version = "0.3.7" -criteria = "safe-to-deploy" - [[exemptions.find-msvc-tools]] version = "0.1.9" criteria = "safe-to-run" @@ -245,14 +197,6 @@ criteria = "safe-to-deploy" version = "0.17.1" criteria = "safe-to-deploy" -[[exemptions.heck]] -version = "0.5.0" -criteria = "safe-to-deploy" - -[[exemptions.hex]] -version = "0.4.3" -criteria = "safe-to-deploy" - [[exemptions.hmac]] version = "0.12.1" criteria = "safe-to-run" @@ -265,10 +209,6 @@ criteria = "safe-to-deploy" version = "0.2.4" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.inout]] version = "0.1.4" criteria = "safe-to-run" @@ -317,10 +257,6 @@ criteria = "safe-to-deploy" version = "2.8.2" criteria = "safe-to-deploy" -[[exemptions.miniz_oxide]] -version = "0.8.9" -criteria = "safe-to-deploy" - [[exemptions.moxcms]] version = "0.8.1" criteria = "safe-to-deploy" @@ -329,10 +265,6 @@ criteria = "safe-to-deploy" version = "0.2.2" criteria = "safe-to-deploy" -[[exemptions.num-traits]] -version = "0.2.19" -criteria = "safe-to-deploy" - [[exemptions.once_cell]] version = "1.21.4" criteria = "safe-to-deploy" @@ -361,18 +293,10 @@ criteria = "safe-to-deploy" version = "0.18.1" criteria = "safe-to-deploy" -[[exemptions.powerfmt]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.ppmd-rust]] version = "1.4.0" criteria = "safe-to-run" -[[exemptions.proc-macro2]] -version = "1.0.106" -criteria = "safe-to-deploy" - [[exemptions.pxfm]] version = "0.1.29" criteria = "safe-to-deploy" @@ -389,10 +313,6 @@ criteria = "safe-to-run" version = "0.41.0" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.45" -criteria = "safe-to-deploy" - [[exemptions.r-efi]] version = "5.3.0" criteria = "safe-to-run" @@ -421,10 +341,6 @@ criteria = "safe-to-deploy" version = "1.0.150" criteria = "safe-to-deploy" -[[exemptions.sha1]] -version = "0.10.6" -criteria = "safe-to-run" - [[exemptions.sha2]] version = "0.10.9" criteria = "safe-to-deploy" @@ -445,10 +361,6 @@ criteria = "safe-to-deploy" version = "1.1.1" criteria = "safe-to-deploy" -[[exemptions.strsim]] -version = "0.11.1" -criteria = "safe-to-deploy" - [[exemptions.subtle]] version = "2.6.1" criteria = "safe-to-deploy" @@ -493,10 +405,6 @@ criteria = "safe-to-deploy" version = "1.0.24" criteria = "safe-to-deploy" -[[exemptions.utf8parse]] -version = "0.2.2" -criteria = "safe-to-deploy" - [[exemptions.uuid]] version = "1.23.4" criteria = "safe-to-deploy" @@ -505,10 +413,6 @@ criteria = "safe-to-deploy" version = "0.9.5" criteria = "safe-to-deploy" -[[exemptions.wasip2]] -version = "1.0.4+wasi-0.2.12" -criteria = "safe-to-run" - [[exemptions.wasm-bindgen]] version = "0.2.126" criteria = "safe-to-deploy" @@ -537,10 +441,6 @@ criteria = "safe-to-deploy" version = "0.61.2" criteria = "safe-to-deploy" -[[exemptions.wit-bindgen]] -version = "0.57.1" -criteria = "safe-to-run" - [[exemptions.zerocopy]] version = "0.8.52" criteria = "safe-to-deploy" @@ -569,10 +469,6 @@ criteria = "safe-to-deploy" version = "0.6.3" criteria = "safe-to-deploy" -[[exemptions.zmij]] -version = "1.0.21" -criteria = "safe-to-deploy" - [[exemptions.zopfli]] version = "0.8.3" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 06eeba0..d3ce663 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,13 @@ # cargo-vet imports lock +[[publisher.arbitrary]] +version = "1.4.2" +when = "2025-08-14" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + [[publisher.blob-decoder]] version = "0.1.1" when = "2026-07-11" @@ -8,6 +15,27 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" +[[publisher.bumpalo]] +version = "3.20.3" +when = "2026-05-22" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + +[[publisher.derive_arbitrary]] +version = "1.4.2" +when = "2025-08-14" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + +[[publisher.encoding_rs]] +version = "0.8.35" +when = "2024-10-24" +user-id = 4484 +user-login = "hsivonen" +user-name = "Henri Sivonen" + [[publisher.forensic-carve]] version = "0.1.0" when = "2026-07-23" @@ -36,6 +64,13 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" +[[publisher.jsonguard]] +version = "0.2.5" +when = "2026-08-02" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[publisher.protobuf-forensic-core]] version = "0.1.0" when = "2026-07-11" @@ -43,10 +78,520 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" -[audits.bytecode-alliance.audits] +[[publisher.wasip2]] +version = "1.0.4+wasi-0.2.12" +when = "2026-06-12" +user-id = 1 +user-login = "alexcrichton" +user-name = "Alex Crichton" + +[[publisher.wit-bindgen]] +version = "0.57.1" +when = "2026-04-17" +trusted-publisher = "github:bytecodealliance/wit-bindgen" + +[[audits.bytecode-alliance.wildcard-audits.arbitrary]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2020-01-14" +end = "2026-08-21" +notes = "I am an author of this crate." + +[[audits.bytecode-alliance.wildcard-audits.bumpalo]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2019-03-16" +end = "2026-08-21" + +[[audits.bytecode-alliance.wildcard-audits.derive_arbitrary]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2020-01-14" +end = "2026-08-21" +notes = "I am an author of this crate" + +[[audits.bytecode-alliance.wildcard-audits.wasip2]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +user-id = 1 # Alex Crichton (alexcrichton) +start = "2025-08-10" +end = "2026-08-21" +notes = """ +This is a Bytecode Alliance authored crate. +""" + +[[audits.bytecode-alliance.wildcard-audits.wit-bindgen]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +trusted-publisher = "github:bytecodealliance/wit-bindgen" +start = "2025-08-13" +end = "2027-01-08" +notes = "The Bytecode Alliance is the author of this crate" + +[[audits.bytecode-alliance.audits.adler2]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "2.0.0" +notes = "Fork of the original `adler` crate, zero unsfae code, works in `no_std`, does what it says on th tin." + +[[audits.bytecode-alliance.audits.cipher]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +version = "0.4.4" +notes = "Most unsafe is hidden by `inout` dependency; only remaining unsafe is raw-splitting a slice and an unreachable hint. Older versions of this regularly reach ~150k daily downloads." + +[[audits.bytecode-alliance.audits.heck]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.4.1 -> 0.5.0" +notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected." + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "0.7.1" +notes = """ +This crate is a Rust implementation of zlib compression/decompression and has +been used by default by the Rust standard library for quite some time. It's also +a default dependency of the popular `backtrace` crate for decompressing debug +information. This crate forbids unsafe code and does not otherwise access system +resources. It's originally a port of the `miniz.c` library as well, and given +its own longevity should be relatively hardened against some of the more common +compression-related issues. +""" + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.7.1 -> 0.8.0" +notes = "Minor updates, using new Rust features like `const`, no major changes." + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.8.0 -> 0.8.5" +notes = """ +Lots of small updates here and there, for example around modernizing Rust +idioms. No new `unsafe` code and everything looks like what you'd expect a +compression library to be doing. +""" + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.8.5 -> 0.8.9" +notes = "No new unsafe code, just refactorings." + +[[audits.bytecode-alliance.audits.num-traits]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +version = "0.2.19" +notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." + +[[audits.bytecode-alliance.audits.sha1]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +delta = "0.10.5 -> 0.10.6" +notes = "Only new code is some loongarch64 additions which include assembly code for that platform." + +[[audits.embark.audits.utf8parse]] +who = "Johan Andersson " +criteria = "safe-to-deploy" +version = "0.2.1" +notes = "Single unsafe usage that looks sound, no ambient capabilities" + +[[audits.google.audits.base64]] +who = "amarjotgill " +criteria = "safe-to-deploy" +version = "0.22.1" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.byteorder]] +who = "danakj " +criteria = "safe-to-deploy" +version = "1.5.0" +notes = "Unsafe review in https://crrev.com/c/5838022" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.color_quant]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "1.1.0" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.equivalent]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "1.0.1" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.equivalent]] +who = "Jonathan Hao " +criteria = "safe-to-deploy" +delta = "1.0.1 -> 1.0.2" +notes = "No changes to any .rs files or Rust code." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.3.4" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'` +and there were no hits. + +Note that some additional, internal notes about an older version of this crate +can be found at go/image-crate-chromium-security-review. +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "0.3.4 -> 0.3.5" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "0.3.5 -> 0.3.6" +notes = "No unsafe, no crypto, mysterious tables replaced with const expressions" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "0.3.6 -> 0.3.7" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.heck]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.4.1" +notes = """ +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` +and there were no hits. + +`heck` (version `0.3.3`) has been added to Chromium in +https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.0.78" +notes = """ +Grepped for "crypt", "cipher", "fs", "net" - there were no hits +(except for a benign "fs" hit in a doc comment) + +Notes from the `unsafe` review can be found in https://crrev.com/c/5385745. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.78 -> 1.0.79" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.79 -> 1.0.80" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.80 -> 1.0.81" +notes = "Comment changes only" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.81 -> 1.0.82" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.82 -> 1.0.83" +notes = "Substantive change is replacing String with Box, saving memory." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.83 -> 1.0.84" +notes = "Only doc comment changes in `src/lib.rs`." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj@chromium.org" +criteria = "safe-to-deploy" +delta = "1.0.84 -> 1.0.85" +notes = "Test-only changes." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.85 -> 1.0.86" +notes = """ +Comment-only changes in `build.rs`. +Reordering of `Cargo.toml` entries. +Just bumping up the version number in `lib.rs`. +Config-related changes in `test_size.rs`. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.86 -> 1.0.87" +notes = "No new unsafe interactions." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Liza Burakova