From 92ddaa20f9b0d8eb0b701599efd56e36815ea51e Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Thu, 3 Oct 2024 21:05:07 -0500 Subject: [PATCH] v1.18: ci: ignore the tonic audit as a temporary stopgap (backport of #3052) (#3062) * ci: ignore the tonic audit as a temporary stopgap (#3052) (cherry picked from commit 9b5525d1270440601d7fe7980ab6b0652bf4fd01) # Conflicts: # ci/do-audit.sh * Fix conflicts * Update to mimic v2.0 change --------- Co-authored-by: Yihau Chen Co-authored-by: WillHickey --- ci/do-audit.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ci/do-audit.sh b/ci/do-audit.sh index ca3902d07f6619..1f4ed5e294e6ff 100755 --- a/ci/do-audit.sh +++ b/ci/do-audit.sh @@ -41,6 +41,12 @@ cargo_audit_ignores=( # openssl --ignore RUSTSEC-2024-0357 + + # tonic + # When using tonic::transport::Server there is a remote DoS attack that can cause + # the server to exit cleanly on accepting a tcp/tls stream. + # Ignoring because we do not use this functionality. + --ignore RUSTSEC-2024-0376 ) scripts/cargo-for-all-lock-files.sh audit "${cargo_audit_ignores[@]}" | $dep_tree_filter # we want the `cargo audit` exit code, not `$dep_tree_filter`'s