Skip to content

Commit

Permalink
qa: cargo vet prune
Browse files Browse the repository at this point in the history
  • Loading branch information
@str4d
str4d committed Sep 15, 2023
1 parent 4e76ad5 commit 11ac76d
Show file tree
Hide file tree
Showing 2 changed files with 108 additions and 38 deletions.
32 changes: 0 additions & 32 deletions qa/supply-chain/config.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,6 @@ url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
version = "0.17.0"
criteria = "safe-to-deploy"

[[exemptions.adler]]
version = "1.0.2"
criteria = "safe-to-deploy"

[[exemptions.aead]]
version = "0.4.3"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -251,10 +247,6 @@ criteria = "safe-to-deploy"
version = "0.3.1"
criteria = "safe-to-deploy"

[[exemptions.hmac]]
version = "0.12.1"
criteria = "safe-to-deploy"

[[exemptions.home]]
version = "0.5.5"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -451,10 +443,6 @@ criteria = "safe-to-deploy"
version = "0.8.0"
criteria = "safe-to-deploy"

[[exemptions.pin-project-lite]]
version = "0.2.9"
criteria = "safe-to-deploy"

[[exemptions.poly1305]]
version = "0.7.2"
criteria = "safe-to-deploy"
Expand All @@ -475,10 +463,6 @@ criteria = "safe-to-deploy"
version = "1.2.1"
criteria = "safe-to-deploy"

[[exemptions.proc-macro2]]
version = "1.0.63"
criteria = "safe-to-deploy"

[[exemptions.proptest]]
version = "1.2.0"
criteria = "safe-to-deploy"
Expand All @@ -499,14 +483,6 @@ criteria = "safe-to-deploy"
version = "0.8.5"
criteria = "safe-to-deploy"

[[exemptions.rand_chacha]]
version = "0.3.1"
criteria = "safe-to-deploy"

[[exemptions.rand_core]]
version = "0.6.4"
criteria = "safe-to-deploy"

[[exemptions.raw-cpuid]]
version = "10.6.0"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -595,10 +571,6 @@ criteria = "safe-to-deploy"
version = "1.0.81"
criteria = "safe-to-deploy"

[[exemptions.sha2]]
version = "0.9.9"
criteria = "safe-to-deploy"

[[exemptions.sharded-slab]]
version = "0.1.4"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -651,10 +623,6 @@ criteria = "safe-to-deploy"
version = "0.3.20"
criteria = "safe-to-deploy"

[[exemptions.time-core]]
version = "0.1.0"
criteria = "safe-to-deploy"

[[exemptions.time-macros]]
version = "0.2.7"
criteria = "safe-to-deploy"
Expand Down
114 changes: 108 additions & 6 deletions qa/supply-chain/imports.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,12 @@ user-id = 696 # Nick Fitzgerald (fitzgen)
start = "2019-03-16"
end = "2024-03-10"

[[audits.bytecode-alliance.audits.adler]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
version = "1.0.2"
notes = "This is a small crate which forbids unsafe code and is a straightforward implementation of the adler hashing algorithm."

[[audits.bytecode-alliance.audits.anyhow]]
who = "Pat Hickey <phickey@fastly.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -226,6 +232,20 @@ who = "Pat Hickey <phickey@fastly.com>"
criteria = "safe-to-deploy"
version = "0.1.0"

[[audits.bytecode-alliance.audits.proc-macro2]]
who = "Pat Hickey <phickey@fastly.com>"
criteria = "safe-to-deploy"
delta = "1.0.51 -> 1.0.57"

[[audits.bytecode-alliance.audits.proc-macro2]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "1.0.59 -> 1.0.63"
notes = """
This is a routine update for new nightly features and new syntax popping up on
nightly, nothing out of the ordinary.
"""

[[audits.bytecode-alliance.audits.quote]]
who = "Pat Hickey <phickey@fastly.com>"
criteria = "safe-to-deploy"
Expand All @@ -237,12 +257,6 @@ criteria = "safe-to-deploy"
version = "0.1.21"
notes = "I am the author of this crate."

[[audits.bytecode-alliance.audits.sha2]]
who = "Benjamin Bouvier <public@benj.me>"
criteria = "safe-to-deploy"
delta = "0.9.9 -> 0.10.2"
notes = "This upgrade is mostly a code refactor, as far as I can tell. No new uses of unsafe nor any new ambient capabilities usage."

[[audits.bytecode-alliance.audits.tempfile]]
who = "Pat Hickey <phickey@fastly.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -341,6 +355,13 @@ that the RNG here is not cryptographically secure.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.pin-project-lite]]
who = "David Koloski <dkoloski@google.com>"
criteria = "safe-to-deploy"
version = "0.2.9"
notes = "Reviewed on https://fxrev.dev/824504"
aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

[[audits.google.audits.version_check]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -421,6 +442,11 @@ criteria = "safe-to-deploy"
delta = "0.2.9 -> 0.2.10"
notes = "These changes include some new `unsafe` code for the `emscripten` and `psvita` targets, but all it does is call `libc::getentropy`."

[[audits.isrg.audits.hmac]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.12.1"

[[audits.isrg.audits.once_cell]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
Expand All @@ -436,6 +462,16 @@ who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.0"

[[audits.isrg.audits.rand_chacha]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.1"

[[audits.isrg.audits.rand_core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.6.3"

[[audits.isrg.audits.rayon]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -516,6 +552,11 @@ who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.94 -> 1.0.95"

[[audits.isrg.audits.sha2]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.10.2"

[[audits.isrg.audits.universal-hash]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -788,6 +829,55 @@ criteria = "safe-to-deploy"
delta = "0.2.16 -> 0.2.17"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.proc-macro2]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.0.39"
notes = """
`proc-macro2` acts as either a thin(-ish) wrapper around the std-provided
`proc_macro` crate, or as a fallback implementation of the crate, depending on
where it is used.

If using this crate on older versions of rustc (1.56 and earlier), it will
temporarily replace the panic handler while initializing in order to detect if
it is running within a `proc_macro`, which could lead to surprising behaviour.
This should not be an issue for more recent compiler versions, which support
`proc_macro::is_available()`.

The `proc-macro2` crate's fallback behaviour is not identical to the complex
behaviour of the rustc compiler (e.g. it does not perform unicode normalization
for identifiers), however it behaves well enough for its intended use-case
(tests and scripts processing rust code).

`proc-macro2` does not use unsafe code, however exposes one `unsafe` API to
allow bypassing checks in the fallback implementation when constructing
`Literal` using `from_str_unchecked`. This was intended to only be used by the
`quote!` macro, however it has been removed
(https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078),
and is likely completely unused. Even when used, this API shouldn't be able to
cause unsoundness.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.39 -> 1.0.43"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.43 -> 1.0.49"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.proc-macro2]]
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.0.57 -> 1.0.59"
notes = "Enabled on Wasm"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"

[[audits.mozilla.audits.quote]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -823,6 +913,12 @@ delta = "1.0.27 -> 1.0.28"
notes = "Enabled on wasm targets"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"

[[audits.mozilla.audits.rand_core]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.6.3 -> 0.6.4"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.rayon]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -933,6 +1029,12 @@ criteria = "safe-to-deploy"
delta = "0.10.2 -> 0.10.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.time-core]]
who = "Kershaw Chang <kershaw@mozilla.com>"
criteria = "safe-to-deploy"
version = "0.1.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.mozilla.audits.typenum]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
Expand Down

0 comments on commit 11ac76d

Please sign in to comment.