From ba0fc9bfec2338ec266fb7b957e20d6706fff18b Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 06:51:28 -0700 Subject: [PATCH 1/3] ci: adopt the fleet reusable workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the hand-maintained ci.yml with a call to SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to 619094ad54edc586f5c2733358e00326b30790bd. What the old gate enforced, and where each piece went: fmt / clippy / test (3-OS) / deny / secrets / docs / fuzz-check -> the shared workflow's equivalent jobs, same shape. msrv (1.96, `cargo test --all-features`) and msrv-libs (1.80, `cargo build -p sqlite-core -p sqlite-forensic`) -> the shared per-member MSRV matrix, which reads each member's declared rust-version: sqlite-cli 1.96, sqlite-core 1.80, sqlite-forensic 1.80. msrv-check is left at the default `build`. `test` would newly RUN the suite at 1.80, which the old msrv-libs job never did; `build` only drops the test-at-1.96 strictness, and the stable test job still covers that ground. coverage (`--fail-under-functions 100`) -> kept VERBATIM as the `coverage` job, with coverage-gate: "off" on the call. The shared coverage inputs express LINE gates only; inheriting the `strict` default would impose a 100%-line gate this repo has never met (measured on this tree: 100.00% functions, 97.02% lines). package completeness / geiger -> copied verbatim below `ci:`, unchanged. The caller keeps `env: RUSTFLAGS: -D warnings` because a called workflow does not inherit the caller's env — without it the three verbatim jobs would run relaxed relative to before. NEW gate this adoption adds: cargo-vet. The repo carries supply-chain/ {config,audits,imports}.toml but its ci.yml had no vet job, and the shared workflow runs one by default. Left on deliberately (ADR-0018), flagged here because it is an addition, not a carry-over. Knowingly NOT carried across (no input expresses it): * `cargo test` on DEFAULT features. The old test job ran the suite twice, once default and once --all-features; the shared job runs --all-features only. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 121 +++++++-------------------------------- 1 file changed, 21 insertions(+), 100 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 89c1129..73435d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,44 +6,33 @@ on: pull_request: branches: [main] +permissions: + contents: read + +# Retained for the repo-specific jobs BELOW `ci:` only — a called workflow does +# not inherit the caller's `env:`, so this block governs nothing in `ci:`. The +# old ci.yml ran the coverage/package/geiger jobs under `-D warnings`; dropping +# it here would quietly relax them. env: CARGO_TERM_COLOR: always RUSTFLAGS: -D warnings jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: rustfmt - - run: cargo fmt --check + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd + with: + # The old coverage job gated on FUNCTIONS (`--fail-under-functions 100`), + # which no input here can express — a line gate is a different assertion, + # and inheriting the `strict` default would impose a 100%-LINE gate this + # repo has never met (measured 97.02% lines / 100% functions). The original + # job is preserved verbatim below; turning the shared one off keeps it the + # single coverage gate, exactly as before. + coverage-gate: "off" - clippy: - name: Clippy - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo clippy --all-targets --all-features -- -D warnings - - test: - name: Test (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test # default features - - run: cargo test --all-features # serde JSON output + # --------------------------------------------------------------------------- + # Copied VERBATIM from the pre-adoption ci.yml. Each expresses something the + # shared workflow has no input for. + # --------------------------------------------------------------------------- coverage: name: Coverage @@ -62,36 +51,6 @@ jobs: # the function gate is the meaningful invariant. - run: cargo llvm-cov --all-features --fail-under-functions 100 --show-missing-lines - msrv: - name: MSRV (1.96) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.96.0 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo test --all-features - - # The published libraries promise a LOW MSRV (a crates.io compatibility signal), - # distinct from the dev toolchain pin and the app's MSRV above. Build ONLY the - # libs against the floor; the CLI app legitimately requires the newer toolchain. - msrv-libs: - name: Library MSRV (1.80) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.80.0 - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo build -p sqlite-core -p sqlite-forensic --all-features - - deny: - name: cargo-deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@v2 # renovate: pin digest - with: - command: check - # crates.io only gates description + license fields, not the README/LICENSE # files — assert every publishable crate actually packages both. package: @@ -112,35 +71,6 @@ jobs: echo "✓ $p packages README.md + LICENSE" done - fuzz-check: - name: Fuzz targets compile (nightly) - runs-on: ubuntu-latest - # cargo-fuzz builds with the host nightly; warnings in its own deps must not - # fail the install, so this job does not deny warnings. - env: - RUSTFLAGS: "" - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@nightly - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: cargo install cargo-fuzz - - run: cargo +nightly fuzz check - - secrets: - name: Secret Scan (gitleaks) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: Install gitleaks - run: | - VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name[1:]') - curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar xz -C /tmp gitleaks - - name: Run gitleaks - run: /tmp/gitleaks detect --source . - geiger: name: Unsafe Audit (cargo-geiger) runs-on: ubuntu-latest @@ -151,12 +81,3 @@ jobs: - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - run: cargo install cargo-geiger --locked - run: cargo geiger 2>&1 || true - - docs: - name: Docs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8 - - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features From f2da748c7d0963fda86a13ff8dc71a7de31f0fd9 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 16:19:50 -0700 Subject: [PATCH 2/3] ci: repin fleet-ci so this repo's own deny.toml is used MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `ci / cargo-deny` fails on this PR, and not because of anything in this repository. The pin `619094ad` predates the one commit that changed `deny-config-repo`'s default, so CI runs: deny-config-repo: SecurityRonin/fleet-config cargo deny check --config .fleet-config/deny.toml all The shared config carries 21 bare RUSTSEC ignores with no reason and no removal condition, and — the part that matters here — it OVERRIDES this repo's own deny.toml, which already carries honest, reasoned ignores with removal conditions for exactly the advisories now being reported. Measured both ways: against this repo's own config `cargo deny check` passes; against the shared config it fails. So the failure is the wrong config being used, not a missing suppression. Adding new ignores would be suppression layered on top of policy that already passes. Repinned to f9802dca, where the default is the repository's own deny.toml and opting into the shared one is explicit. One line; no deny.toml, vet or source change anywhere. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 73435d8..6371656 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ env: jobs: ci: - uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3 with: # The old coverage job gated on FUNCTIONS (`--fail-under-functions 100`), # which no input here can express — a line gate is a different assertion, From f2d3153ac9d7b8196f79aa717872ecb4ec56a234 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 16:59:25 -0700 Subject: [PATCH 3/3] fix(supply-chain): vet records for the versions the MSRV pin resolves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pinning a dependency down to keep this repo's declared MSRV achievable moved the resolved set, and the vet store had no record for the versions that came out. Each takes the strongest mechanism that applies per ADR-0018: publisher trust for crates we publish or whose publisher an imported aggregate auditor already vouches for, and honest [[exemptions]] only for the remainder. An exemption asserts that nobody audited the crate — equally true before and after a version change — so refreshing one claims nothing new. No `cargo vet certify --accept-all`: a certify record asserts a human read the source, so bulk-certifying fabricates the condition being claimed. audits.toml carries zero self-certified entries after this change. `cargo vet --locked` passes. --- supply-chain/audits.toml | 42 ++- supply-chain/config.toml | 104 ------- supply-chain/imports.lock | 553 +++++++++++++++++++++++++++++++++++++- 3 files changed, 588 insertions(+), 111 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 3fe9dcc..596ed9d 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -9,32 +9,68 @@ user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-11" end = "2027-08-01" +[[trusted.ewf]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-03-05" +end = "2027-08-07" + [[trusted.forensic-carve]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-23" end = "2027-08-01" +[[trusted.forensic-vfs]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-07" +end = "2027-08-07" + [[trusted.forensicnomicon]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-05" -end = "2027-08-01" +end = "2027-08-07" [[trusted.forensicnomicon-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-01" +end = "2027-08-07" [[trusted.forensicnomicon-data]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-01" +end = "2027-08-07" + +[[trusted.jsonguard]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-05-21" +end = "2027-08-07" [[trusted.protobuf-forensic-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-11" end = "2027-08-01" + +[[trusted.safe-decode]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-08-02" +end = "2027-08-07" + +[[trusted.safe-read]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-15" +end = "2027-08-07" + +[[trusted.state-history-forensic]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-16" +end = "2027-08-07" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 983b89c..b4b58c5 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -25,10 +25,6 @@ audit-as-crates-io = false [policy.sqlite4n6] audit-as-crates-io = false -[[exemptions.adler2]] -version = "2.0.1" -criteria = "safe-to-deploy" - [[exemptions.aes]] version = "0.8.4" criteria = "safe-to-run" @@ -57,10 +53,6 @@ criteria = "safe-to-deploy" version = "3.0.11" criteria = "safe-to-deploy" -[[exemptions.arbitrary]] -version = "1.4.2" -criteria = "safe-to-run" - [[exemptions.atoi_simd]] version = "0.17.0" criteria = "safe-to-run" @@ -69,10 +61,6 @@ criteria = "safe-to-run" version = "1.5.1" criteria = "safe-to-deploy" -[[exemptions.base64]] -version = "0.22.1" -criteria = "safe-to-deploy" - [[exemptions.bitflags]] version = "2.13.0" criteria = "safe-to-deploy" @@ -81,18 +69,10 @@ criteria = "safe-to-deploy" version = "0.10.4" criteria = "safe-to-deploy" -[[exemptions.bumpalo]] -version = "3.20.3" -criteria = "safe-to-deploy" - [[exemptions.bytemuck]] version = "1.25.0" criteria = "safe-to-deploy" -[[exemptions.byteorder]] -version = "1.5.0" -criteria = "safe-to-run" - [[exemptions.byteorder-lite]] version = "0.1.0" criteria = "safe-to-deploy" @@ -113,10 +93,6 @@ criteria = "safe-to-run" version = "1.0.4" criteria = "safe-to-deploy" -[[exemptions.cipher]] -version = "0.4.4" -criteria = "safe-to-run" - [[exemptions.clap]] version = "4.6.1" criteria = "safe-to-deploy" @@ -137,10 +113,6 @@ criteria = "safe-to-deploy" version = "0.1.2" criteria = "safe-to-run" -[[exemptions.color_quant]] -version = "1.1.0" -criteria = "safe-to-deploy" - [[exemptions.colorchoice]] version = "1.0.5" criteria = "safe-to-deploy" @@ -173,26 +145,10 @@ criteria = "safe-to-run" version = "0.1.12" criteria = "safe-to-run" -[[exemptions.deranged]] -version = "0.5.8" -criteria = "safe-to-deploy" - -[[exemptions.derive_arbitrary]] -version = "1.4.2" -criteria = "safe-to-run" - [[exemptions.digest]] version = "0.10.7" criteria = "safe-to-deploy" -[[exemptions.encoding_rs]] -version = "0.8.35" -criteria = "safe-to-run" - -[[exemptions.equivalent]] -version = "1.0.2" -criteria = "safe-to-deploy" - [[exemptions.fast-float2]] version = "0.2.3" criteria = "safe-to-run" @@ -201,10 +157,6 @@ criteria = "safe-to-run" version = "0.2.7" criteria = "safe-to-deploy" -[[exemptions.fdeflate]] -version = "0.3.7" -criteria = "safe-to-deploy" - [[exemptions.find-msvc-tools]] version = "0.1.9" criteria = "safe-to-run" @@ -245,14 +197,6 @@ criteria = "safe-to-deploy" version = "0.17.1" criteria = "safe-to-deploy" -[[exemptions.heck]] -version = "0.5.0" -criteria = "safe-to-deploy" - -[[exemptions.hex]] -version = "0.4.3" -criteria = "safe-to-deploy" - [[exemptions.hmac]] version = "0.12.1" criteria = "safe-to-run" @@ -265,10 +209,6 @@ criteria = "safe-to-deploy" version = "0.2.4" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.inout]] version = "0.1.4" criteria = "safe-to-run" @@ -317,10 +257,6 @@ criteria = "safe-to-deploy" version = "2.8.2" criteria = "safe-to-deploy" -[[exemptions.miniz_oxide]] -version = "0.8.9" -criteria = "safe-to-deploy" - [[exemptions.moxcms]] version = "0.8.1" criteria = "safe-to-deploy" @@ -329,10 +265,6 @@ criteria = "safe-to-deploy" version = "0.2.2" criteria = "safe-to-deploy" -[[exemptions.num-traits]] -version = "0.2.19" -criteria = "safe-to-deploy" - [[exemptions.once_cell]] version = "1.21.4" criteria = "safe-to-deploy" @@ -361,18 +293,10 @@ criteria = "safe-to-deploy" version = "0.18.1" criteria = "safe-to-deploy" -[[exemptions.powerfmt]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.ppmd-rust]] version = "1.4.0" criteria = "safe-to-run" -[[exemptions.proc-macro2]] -version = "1.0.106" -criteria = "safe-to-deploy" - [[exemptions.pxfm]] version = "0.1.29" criteria = "safe-to-deploy" @@ -389,10 +313,6 @@ criteria = "safe-to-run" version = "0.41.0" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.45" -criteria = "safe-to-deploy" - [[exemptions.r-efi]] version = "5.3.0" criteria = "safe-to-run" @@ -421,10 +341,6 @@ criteria = "safe-to-deploy" version = "1.0.150" criteria = "safe-to-deploy" -[[exemptions.sha1]] -version = "0.10.6" -criteria = "safe-to-run" - [[exemptions.sha2]] version = "0.10.9" criteria = "safe-to-deploy" @@ -445,10 +361,6 @@ criteria = "safe-to-deploy" version = "1.1.1" criteria = "safe-to-deploy" -[[exemptions.strsim]] -version = "0.11.1" -criteria = "safe-to-deploy" - [[exemptions.subtle]] version = "2.6.1" criteria = "safe-to-deploy" @@ -493,10 +405,6 @@ criteria = "safe-to-deploy" version = "1.0.24" criteria = "safe-to-deploy" -[[exemptions.utf8parse]] -version = "0.2.2" -criteria = "safe-to-deploy" - [[exemptions.uuid]] version = "1.23.4" criteria = "safe-to-deploy" @@ -505,10 +413,6 @@ criteria = "safe-to-deploy" version = "0.9.5" criteria = "safe-to-deploy" -[[exemptions.wasip2]] -version = "1.0.4+wasi-0.2.12" -criteria = "safe-to-run" - [[exemptions.wasm-bindgen]] version = "0.2.126" criteria = "safe-to-deploy" @@ -537,10 +441,6 @@ criteria = "safe-to-deploy" version = "0.61.2" criteria = "safe-to-deploy" -[[exemptions.wit-bindgen]] -version = "0.57.1" -criteria = "safe-to-run" - [[exemptions.zerocopy]] version = "0.8.52" criteria = "safe-to-deploy" @@ -569,10 +469,6 @@ criteria = "safe-to-deploy" version = "0.6.3" criteria = "safe-to-deploy" -[[exemptions.zmij]] -version = "1.0.21" -criteria = "safe-to-deploy" - [[exemptions.zopfli]] version = "0.8.3" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 06eeba0..d3ce663 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,13 @@ # cargo-vet imports lock +[[publisher.arbitrary]] +version = "1.4.2" +when = "2025-08-14" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + [[publisher.blob-decoder]] version = "0.1.1" when = "2026-07-11" @@ -8,6 +15,27 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" +[[publisher.bumpalo]] +version = "3.20.3" +when = "2026-05-22" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + +[[publisher.derive_arbitrary]] +version = "1.4.2" +when = "2025-08-14" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + +[[publisher.encoding_rs]] +version = "0.8.35" +when = "2024-10-24" +user-id = 4484 +user-login = "hsivonen" +user-name = "Henri Sivonen" + [[publisher.forensic-carve]] version = "0.1.0" when = "2026-07-23" @@ -36,6 +64,13 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" +[[publisher.jsonguard]] +version = "0.2.5" +when = "2026-08-02" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[publisher.protobuf-forensic-core]] version = "0.1.0" when = "2026-07-11" @@ -43,10 +78,520 @@ user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" -[audits.bytecode-alliance.audits] +[[publisher.wasip2]] +version = "1.0.4+wasi-0.2.12" +when = "2026-06-12" +user-id = 1 +user-login = "alexcrichton" +user-name = "Alex Crichton" + +[[publisher.wit-bindgen]] +version = "0.57.1" +when = "2026-04-17" +trusted-publisher = "github:bytecodealliance/wit-bindgen" + +[[audits.bytecode-alliance.wildcard-audits.arbitrary]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2020-01-14" +end = "2026-08-21" +notes = "I am an author of this crate." + +[[audits.bytecode-alliance.wildcard-audits.bumpalo]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2019-03-16" +end = "2026-08-21" + +[[audits.bytecode-alliance.wildcard-audits.derive_arbitrary]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2020-01-14" +end = "2026-08-21" +notes = "I am an author of this crate" + +[[audits.bytecode-alliance.wildcard-audits.wasip2]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +user-id = 1 # Alex Crichton (alexcrichton) +start = "2025-08-10" +end = "2026-08-21" +notes = """ +This is a Bytecode Alliance authored crate. +""" + +[[audits.bytecode-alliance.wildcard-audits.wit-bindgen]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +trusted-publisher = "github:bytecodealliance/wit-bindgen" +start = "2025-08-13" +end = "2027-01-08" +notes = "The Bytecode Alliance is the author of this crate" + +[[audits.bytecode-alliance.audits.adler2]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "2.0.0" +notes = "Fork of the original `adler` crate, zero unsfae code, works in `no_std`, does what it says on th tin." + +[[audits.bytecode-alliance.audits.cipher]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +version = "0.4.4" +notes = "Most unsafe is hidden by `inout` dependency; only remaining unsafe is raw-splitting a slice and an unreachable hint. Older versions of this regularly reach ~150k daily downloads." + +[[audits.bytecode-alliance.audits.heck]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.4.1 -> 0.5.0" +notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected." + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "0.7.1" +notes = """ +This crate is a Rust implementation of zlib compression/decompression and has +been used by default by the Rust standard library for quite some time. It's also +a default dependency of the popular `backtrace` crate for decompressing debug +information. This crate forbids unsafe code and does not otherwise access system +resources. It's originally a port of the `miniz.c` library as well, and given +its own longevity should be relatively hardened against some of the more common +compression-related issues. +""" + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.7.1 -> 0.8.0" +notes = "Minor updates, using new Rust features like `const`, no major changes." + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.8.0 -> 0.8.5" +notes = """ +Lots of small updates here and there, for example around modernizing Rust +idioms. No new `unsafe` code and everything looks like what you'd expect a +compression library to be doing. +""" + +[[audits.bytecode-alliance.audits.miniz_oxide]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.8.5 -> 0.8.9" +notes = "No new unsafe code, just refactorings." + +[[audits.bytecode-alliance.audits.num-traits]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +version = "0.2.19" +notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." + +[[audits.bytecode-alliance.audits.sha1]] +who = "Andrew Brown " +criteria = "safe-to-deploy" +delta = "0.10.5 -> 0.10.6" +notes = "Only new code is some loongarch64 additions which include assembly code for that platform." + +[[audits.embark.audits.utf8parse]] +who = "Johan Andersson " +criteria = "safe-to-deploy" +version = "0.2.1" +notes = "Single unsafe usage that looks sound, no ambient capabilities" + +[[audits.google.audits.base64]] +who = "amarjotgill " +criteria = "safe-to-deploy" +version = "0.22.1" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.byteorder]] +who = "danakj " +criteria = "safe-to-deploy" +version = "1.5.0" +notes = "Unsafe review in https://crrev.com/c/5838022" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.color_quant]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "1.1.0" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.equivalent]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "1.0.1" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.equivalent]] +who = "Jonathan Hao " +criteria = "safe-to-deploy" +delta = "1.0.1 -> 1.0.2" +notes = "No changes to any .rs files or Rust code." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.3.4" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'` +and there were no hits. + +Note that some additional, internal notes about an older version of this crate +can be found at go/image-crate-chromium-security-review. +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "0.3.4 -> 0.3.5" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "0.3.5 -> 0.3.6" +notes = "No unsafe, no crypto, mysterious tables replaced with const expressions" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.fdeflate]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "0.3.6 -> 0.3.7" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.heck]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.4.1" +notes = """ +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` +and there were no hits. + +`heck` (version `0.3.3`) has been added to Chromium in +https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.0.78" +notes = """ +Grepped for "crypt", "cipher", "fs", "net" - there were no hits +(except for a benign "fs" hit in a doc comment) + +Notes from the `unsafe` review can be found in https://crrev.com/c/5385745. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.78 -> 1.0.79" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.79 -> 1.0.80" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.80 -> 1.0.81" +notes = "Comment changes only" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.81 -> 1.0.82" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.82 -> 1.0.83" +notes = "Substantive change is replacing String with Box, saving memory." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.83 -> 1.0.84" +notes = "Only doc comment changes in `src/lib.rs`." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj@chromium.org" +criteria = "safe-to-deploy" +delta = "1.0.84 -> 1.0.85" +notes = "Test-only changes." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.85 -> 1.0.86" +notes = """ +Comment-only changes in `build.rs`. +Reordering of `Cargo.toml` entries. +Just bumping up the version number in `lib.rs`. +Config-related changes in `test_size.rs`. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.86 -> 1.0.87" +notes = "No new unsafe interactions." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Liza Burakova