chore(ci): add cargo-vet to the CI for supply-chain protection.

This commit is contained in:
David Niehues
2025-01-30 21:06:45 +01:00
parent 2c64da23f1
commit 6ab4e1152c
5 changed files with 2361 additions and 0 deletions

View File

@@ -42,3 +42,30 @@ jobs:
run: cargo supply-chain publishers
- name: Generate cargo-supply-chain report about crates
run: cargo supply-chain crates
# The setup for cargo-vet follows the recommendations in the cargo-vet documentation: https://mozilla.github.io/cargo-vet/configuring-ci.html
cargo-vet:
name: Vet Dependencies
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/cache@v4
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
key: cargo-vet-cache
- name: Install stable toolchain # Since we are running/compiling cargo-vet, we should rely on the stable toolchain.
run: |
rustup toolchain install stable
rustup default stable
- uses: actions/cache@v4
with:
path: ${{ runner.tool_cache }}/cargo-vet
key: cargo-vet-bin
- name: Add the tool cache directory to the search path
run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
- name: Ensure that the tool cache is populated with the cargo-vet binary
run: cargo install --root ${{ runner.tool_cache }}/cargo-vet cargo-vet
- name: Invoke cargo-vet
run: cargo vet --locked

View File

4
supply-chain/audits.toml Normal file
View File

@@ -0,0 +1,4 @@
# cargo-vet audits file
[audits]

886
supply-chain/config.toml Normal file
View File

@@ -0,0 +1,886 @@
# cargo-vet config file
[cargo-vet]
version = "0.10"
[imports.actix]
url = "https://raw.githubusercontent.com/actix/supply-chain/main/audits.toml"
[imports.bytecode-alliance]
url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml"
[imports.embark-studios]
url = "https://raw.githubusercontent.com/EmbarkStudios/rust-ecosystem/main/audits.toml"
[imports.fermyon]
url = "https://raw.githubusercontent.com/fermyon/spin/main/supply-chain/audits.toml"
[imports.google]
url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
[imports.isrg]
url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"
[imports.mozilla]
url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
[imports.zcash]
url = "https://raw.githubusercontent.com/zcash/rust-ecosystem/main/supply-chain/audits.toml"
[policy.memsec]
audit-as-crates-io = true
[policy.rosenpass]
audit-as-crates-io = false
[policy.uds]
audit-as-crates-io = true
[[exemptions.addr2line]]
version = "0.24.2"
criteria = "safe-to-deploy"
[[exemptions.aead]]
version = "0.5.2"
criteria = "safe-to-deploy"
[[exemptions.aho-corasick]]
version = "1.1.3"
criteria = "safe-to-deploy"
[[exemptions.allocator-api2-tests]]
version = "0.2.15"
criteria = "safe-to-run"
[[exemptions.anstream]]
version = "0.6.15"
criteria = "safe-to-deploy"
[[exemptions.anstyle]]
version = "1.0.8"
criteria = "safe-to-deploy"
[[exemptions.anstyle-parse]]
version = "0.2.5"
criteria = "safe-to-deploy"
[[exemptions.anstyle-query]]
version = "1.1.1"
criteria = "safe-to-deploy"
[[exemptions.anstyle-wincon]]
version = "3.0.4"
criteria = "safe-to-deploy"
[[exemptions.anyhow]]
version = "1.0.95"
criteria = "safe-to-deploy"
[[exemptions.atomic-polyfill]]
version = "1.0.3"
criteria = "safe-to-deploy"
[[exemptions.backtrace]]
version = "0.3.74"
criteria = "safe-to-deploy"
[[exemptions.base64ct]]
version = "1.6.0"
criteria = "safe-to-deploy"
[[exemptions.bincode]]
version = "1.3.3"
criteria = "safe-to-run"
[[exemptions.blake2]]
version = "0.10.6"
criteria = "safe-to-deploy"
[[exemptions.build-deps]]
version = "0.1.4"
criteria = "safe-to-deploy"
[[exemptions.bytes]]
version = "1.7.2"
criteria = "safe-to-deploy"
[[exemptions.cc]]
version = "1.1.30"
criteria = "safe-to-deploy"
[[exemptions.chacha20]]
version = "0.9.1"
criteria = "safe-to-deploy"
[[exemptions.chacha20poly1305]]
version = "0.10.1"
criteria = "safe-to-deploy"
[[exemptions.ciborium]]
version = "0.2.2"
criteria = "safe-to-run"
[[exemptions.ciborium-io]]
version = "0.2.2"
criteria = "safe-to-run"
[[exemptions.ciborium-ll]]
version = "0.2.2"
criteria = "safe-to-run"
[[exemptions.clang-sys]]
version = "1.8.1"
criteria = "safe-to-deploy"
[[exemptions.clap]]
version = "4.5.23"
criteria = "safe-to-deploy"
[[exemptions.clap_builder]]
version = "4.5.23"
criteria = "safe-to-deploy"
[[exemptions.clap_complete]]
version = "4.5.40"
criteria = "safe-to-deploy"
[[exemptions.clap_derive]]
version = "4.5.18"
criteria = "safe-to-deploy"
[[exemptions.clap_lex]]
version = "0.7.4"
criteria = "safe-to-deploy"
[[exemptions.clap_mangen]]
version = "0.2.24"
criteria = "safe-to-deploy"
[[exemptions.cmake]]
version = "0.1.51"
criteria = "safe-to-deploy"
[[exemptions.colorchoice]]
version = "1.0.2"
criteria = "safe-to-deploy"
[[exemptions.command-fds]]
version = "0.2.3"
criteria = "safe-to-deploy"
[[exemptions.cpufeatures]]
version = "0.2.14"
criteria = "safe-to-deploy"
[[exemptions.criterion]]
version = "0.5.1"
criteria = "safe-to-run"
[[exemptions.criterion-plot]]
version = "0.5.0"
criteria = "safe-to-run"
[[exemptions.critical-section]]
version = "1.2.0"
criteria = "safe-to-deploy"
[[exemptions.crossbeam-utils]]
version = "0.8.20"
criteria = "safe-to-run"
[[exemptions.ctrlc-async]]
version = "3.2.2"
criteria = "safe-to-deploy"
[[exemptions.curve25519-dalek]]
version = "4.1.3"
criteria = "safe-to-deploy"
[[exemptions.curve25519-dalek-derive]]
version = "0.1.1"
criteria = "safe-to-deploy"
[[exemptions.darling]]
version = "0.12.4"
criteria = "safe-to-deploy"
[[exemptions.darling]]
version = "0.20.10"
criteria = "safe-to-deploy"
[[exemptions.darling_core]]
version = "0.12.4"
criteria = "safe-to-deploy"
[[exemptions.darling_core]]
version = "0.20.10"
criteria = "safe-to-deploy"
[[exemptions.darling_macro]]
version = "0.12.4"
criteria = "safe-to-deploy"
[[exemptions.darling_macro]]
version = "0.20.10"
criteria = "safe-to-deploy"
[[exemptions.derive_arbitrary]]
version = "1.4.1"
criteria = "safe-to-deploy"
[[exemptions.derive_builder]]
version = "0.10.2"
criteria = "safe-to-deploy"
[[exemptions.derive_builder]]
version = "0.20.2"
criteria = "safe-to-deploy"
[[exemptions.derive_builder_core]]
version = "0.10.2"
criteria = "safe-to-deploy"
[[exemptions.derive_builder_core]]
version = "0.20.2"
criteria = "safe-to-deploy"
[[exemptions.derive_builder_macro]]
version = "0.10.2"
criteria = "safe-to-deploy"
[[exemptions.derive_builder_macro]]
version = "0.20.2"
criteria = "safe-to-deploy"
[[exemptions.digest]]
version = "0.10.7"
criteria = "safe-to-deploy"
[[exemptions.embedded-io]]
version = "0.6.1"
criteria = "safe-to-deploy"
[[exemptions.env_logger]]
version = "0.10.2"
criteria = "safe-to-deploy"
[[exemptions.findshlibs]]
version = "0.10.2"
criteria = "safe-to-run"
[[exemptions.futures-task]]
version = "0.3.31"
criteria = "safe-to-deploy"
[[exemptions.futures-util]]
version = "0.3.31"
criteria = "safe-to-deploy"
[[exemptions.generic-array]]
version = "0.14.7"
criteria = "safe-to-deploy"
[[exemptions.genetlink]]
version = "0.2.5"
criteria = "safe-to-deploy"
[[exemptions.getrandom]]
version = "0.2.15"
criteria = "safe-to-deploy"
[[exemptions.gimli]]
version = "0.31.1"
criteria = "safe-to-deploy"
[[exemptions.half]]
version = "2.4.1"
criteria = "safe-to-run"
[[exemptions.hash32]]
version = "0.2.1"
criteria = "safe-to-deploy"
[[exemptions.hashbrown]]
version = "0.15.2"
criteria = "safe-to-deploy"
[[exemptions.heapless]]
version = "0.7.17"
criteria = "safe-to-deploy"
[[exemptions.hermit-abi]]
version = "0.4.0"
criteria = "safe-to-deploy"
[[exemptions.hex-literal]]
version = "0.4.1"
criteria = "safe-to-deploy"
[[exemptions.home]]
version = "0.5.9"
criteria = "safe-to-deploy"
[[exemptions.humantime]]
version = "2.1.0"
criteria = "safe-to-deploy"
[[exemptions.indexmap]]
version = "2.6.0"
criteria = "safe-to-deploy"
[[exemptions.ipc-channel]]
version = "0.18.3"
criteria = "safe-to-run"
[[exemptions.is-terminal]]
version = "0.4.13"
criteria = "safe-to-deploy"
[[exemptions.is_terminal_polyfill]]
version = "1.70.1"
criteria = "safe-to-deploy"
[[exemptions.jobserver]]
version = "0.1.32"
criteria = "safe-to-deploy"
[[exemptions.js-sys]]
version = "0.3.72"
criteria = "safe-to-deploy"
[[exemptions.lazycell]]
version = "1.3.0"
criteria = "safe-to-deploy"
[[exemptions.libc]]
version = "0.2.168"
criteria = "safe-to-deploy"
[[exemptions.libcrux]]
version = "0.0.2-pre.2"
criteria = "safe-to-deploy"
[[exemptions.libcrux-hacl]]
version = "0.0.2-pre.2"
criteria = "safe-to-deploy"
[[exemptions.libcrux-platform]]
version = "0.0.2-pre.2"
criteria = "safe-to-deploy"
[[exemptions.libfuzzer-sys]]
version = "0.4.8"
criteria = "safe-to-deploy"
[[exemptions.libjade-sys]]
version = "0.0.2-pre.2"
criteria = "safe-to-deploy"
[[exemptions.libloading]]
version = "0.8.5"
criteria = "safe-to-deploy"
[[exemptions.linux-raw-sys]]
version = "0.4.14"
criteria = "safe-to-deploy"
[[exemptions.lock_api]]
version = "0.4.12"
criteria = "safe-to-deploy"
[[exemptions.memchr]]
version = "2.7.4"
criteria = "safe-to-deploy"
[[exemptions.memoffset]]
version = "0.6.5"
criteria = "safe-to-deploy"
[[exemptions.memoffset]]
version = "0.9.1"
criteria = "safe-to-deploy"
[[exemptions.memsec]]
version = "0.6.3@git:aceb9baee8aec6844125bd6612f92e9a281373df"
criteria = "safe-to-deploy"
[[exemptions.minimal-lexical]]
version = "0.2.1"
criteria = "safe-to-deploy"
[[exemptions.mio]]
version = "1.0.3"
criteria = "safe-to-deploy"
[[exemptions.neli]]
version = "0.6.3"
criteria = "safe-to-deploy"
[[exemptions.neli-proc-macros]]
version = "0.1.3"
criteria = "safe-to-deploy"
[[exemptions.netlink-packet-core]]
version = "0.7.0"
criteria = "safe-to-deploy"
[[exemptions.netlink-packet-generic]]
version = "0.3.3"
criteria = "safe-to-deploy"
[[exemptions.netlink-packet-route]]
version = "0.19.0"
criteria = "safe-to-deploy"
[[exemptions.netlink-packet-utils]]
version = "0.5.2"
criteria = "safe-to-deploy"
[[exemptions.netlink-packet-wireguard]]
version = "0.2.3"
criteria = "safe-to-deploy"
[[exemptions.netlink-proto]]
version = "0.11.3"
criteria = "safe-to-deploy"
[[exemptions.netlink-sys]]
version = "0.8.6"
criteria = "safe-to-deploy"
[[exemptions.nix]]
version = "0.23.2"
criteria = "safe-to-deploy"
[[exemptions.nix]]
version = "0.27.1"
criteria = "safe-to-deploy"
[[exemptions.object]]
version = "0.36.5"
criteria = "safe-to-deploy"
[[exemptions.once_cell]]
version = "1.20.2"
criteria = "safe-to-deploy"
[[exemptions.oqs-sys]]
version = "0.9.1+liboqs-0.9.0"
criteria = "safe-to-deploy"
[[exemptions.parking_lot]]
version = "0.12.3"
criteria = "safe-to-deploy"
[[exemptions.parking_lot_core]]
version = "0.9.10"
criteria = "safe-to-deploy"
[[exemptions.paste]]
version = "1.0.15"
criteria = "safe-to-deploy"
[[exemptions.pkg-config]]
version = "0.3.31"
criteria = "safe-to-deploy"
[[exemptions.plotters]]
version = "0.3.7"
criteria = "safe-to-run"
[[exemptions.plotters-backend]]
version = "0.3.7"
criteria = "safe-to-run"
[[exemptions.plotters-svg]]
version = "0.3.7"
criteria = "safe-to-run"
[[exemptions.poly1305]]
version = "0.8.0"
criteria = "safe-to-deploy"
[[exemptions.postcard]]
version = "1.1.1"
criteria = "safe-to-deploy"
[[exemptions.ppv-lite86]]
version = "0.2.20"
criteria = "safe-to-deploy"
[[exemptions.prettyplease]]
version = "0.2.22"
criteria = "safe-to-deploy"
[[exemptions.procspawn]]
version = "1.0.1"
criteria = "safe-to-run"
[[exemptions.psm]]
version = "0.1.23"
criteria = "safe-to-deploy"
[[exemptions.rand]]
version = "0.8.5"
criteria = "safe-to-deploy"
[[exemptions.redox_syscall]]
version = "0.5.7"
criteria = "safe-to-deploy"
[[exemptions.regex]]
version = "1.11.0"
criteria = "safe-to-deploy"
[[exemptions.regex-automata]]
version = "0.4.8"
criteria = "safe-to-deploy"
[[exemptions.roff]]
version = "0.2.2"
criteria = "safe-to-deploy"
[[exemptions.rtnetlink]]
version = "0.14.1"
criteria = "safe-to-deploy"
[[exemptions.rustix]]
version = "0.38.42"
criteria = "safe-to-deploy"
[[exemptions.ryu]]
version = "1.0.18"
criteria = "safe-to-run"
[[exemptions.scc]]
version = "2.2.1"
criteria = "safe-to-run"
[[exemptions.scopeguard]]
version = "1.2.0"
criteria = "safe-to-deploy"
[[exemptions.sdd]]
version = "3.0.4"
criteria = "safe-to-run"
[[exemptions.serde_spanned]]
version = "0.6.8"
criteria = "safe-to-deploy"
[[exemptions.serial_test]]
version = "3.2.0"
criteria = "safe-to-run"
[[exemptions.serial_test_derive]]
version = "3.2.0"
criteria = "safe-to-run"
[[exemptions.signal-hook]]
version = "0.3.17"
criteria = "safe-to-deploy"
[[exemptions.signal-hook-registry]]
version = "1.4.2"
criteria = "safe-to-deploy"
[[exemptions.slab]]
version = "0.4.9"
criteria = "safe-to-deploy"
[[exemptions.socket2]]
version = "0.5.7"
criteria = "safe-to-deploy"
[[exemptions.spin]]
version = "0.9.8"
criteria = "safe-to-deploy"
[[exemptions.stacker]]
version = "0.1.17"
criteria = "safe-to-deploy"
[[exemptions.syn]]
version = "1.0.109"
criteria = "safe-to-deploy"
[[exemptions.syn]]
version = "2.0.87"
criteria = "safe-to-deploy"
[[exemptions.take-until]]
version = "0.1.0"
criteria = "safe-to-deploy"
[[exemptions.tempfile]]
version = "3.14.0"
criteria = "safe-to-deploy"
[[exemptions.termcolor]]
version = "1.4.1"
criteria = "safe-to-deploy"
[[exemptions.test_bin]]
version = "0.4.0"
criteria = "safe-to-run"
[[exemptions.thiserror]]
version = "1.0.69"
criteria = "safe-to-deploy"
[[exemptions.thiserror-impl]]
version = "1.0.69"
criteria = "safe-to-deploy"
[[exemptions.tokio]]
version = "1.42.0"
criteria = "safe-to-deploy"
[[exemptions.tokio-macros]]
version = "2.4.0"
criteria = "safe-to-deploy"
[[exemptions.toml]]
version = "0.7.8"
criteria = "safe-to-deploy"
[[exemptions.toml_datetime]]
version = "0.6.8"
criteria = "safe-to-deploy"
[[exemptions.toml_edit]]
version = "0.19.15"
criteria = "safe-to-deploy"
[[exemptions.typenum]]
version = "1.17.0"
criteria = "safe-to-deploy"
[[exemptions.uds]]
version = "0.4.2@git:b47934fe52422e559f7278938875f9105f91c5a2"
criteria = "safe-to-deploy"
[[exemptions.utf8parse]]
version = "0.2.2"
criteria = "safe-to-deploy"
[[exemptions.uuid]]
version = "1.10.0"
criteria = "safe-to-run"
[[exemptions.version_check]]
version = "0.9.5"
criteria = "safe-to-deploy"
[[exemptions.walkdir]]
version = "2.5.0"
criteria = "safe-to-run"
[[exemptions.wasi]]
version = "0.11.0+wasi-snapshot-preview1"
criteria = "safe-to-deploy"
[[exemptions.wasm-bindgen]]
version = "0.2.95"
criteria = "safe-to-deploy"
[[exemptions.wasm-bindgen-backend]]
version = "0.2.95"
criteria = "safe-to-deploy"
[[exemptions.wasm-bindgen-macro]]
version = "0.2.95"
criteria = "safe-to-deploy"
[[exemptions.wasm-bindgen-macro-support]]
version = "0.2.95"
criteria = "safe-to-deploy"
[[exemptions.wasm-bindgen-shared]]
version = "0.2.95"
criteria = "safe-to-deploy"
[[exemptions.web-sys]]
version = "0.3.72"
criteria = "safe-to-run"
[[exemptions.which]]
version = "4.4.2"
criteria = "safe-to-deploy"
[[exemptions.winapi]]
version = "0.3.9"
criteria = "safe-to-deploy"
[[exemptions.winapi-i686-pc-windows-gnu]]
version = "0.4.0"
criteria = "safe-to-deploy"
[[exemptions.winapi-util]]
version = "0.1.9"
criteria = "safe-to-deploy"
[[exemptions.winapi-x86_64-pc-windows-gnu]]
version = "0.4.0"
criteria = "safe-to-deploy"
[[exemptions.windows]]
version = "0.58.0"
criteria = "safe-to-run"
[[exemptions.windows-core]]
version = "0.58.0"
criteria = "safe-to-run"
[[exemptions.windows-implement]]
version = "0.58.0"
criteria = "safe-to-run"
[[exemptions.windows-interface]]
version = "0.58.0"
criteria = "safe-to-run"
[[exemptions.windows-result]]
version = "0.2.0"
criteria = "safe-to-run"
[[exemptions.windows-strings]]
version = "0.1.0"
criteria = "safe-to-run"
[[exemptions.windows-sys]]
version = "0.45.0"
criteria = "safe-to-deploy"
[[exemptions.windows-sys]]
version = "0.48.0"
criteria = "safe-to-run"
[[exemptions.windows-sys]]
version = "0.52.0"
criteria = "safe-to-deploy"
[[exemptions.windows-sys]]
version = "0.59.0"
criteria = "safe-to-deploy"
[[exemptions.windows-targets]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows-targets]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows-targets]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_aarch64_gnullvm]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_aarch64_gnullvm]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_aarch64_gnullvm]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_aarch64_msvc]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_aarch64_msvc]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_aarch64_msvc]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_i686_gnu]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_i686_gnu]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_i686_gnu]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_i686_gnullvm]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_i686_msvc]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_i686_msvc]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_i686_msvc]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_gnu]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_gnu]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_x86_64_gnu]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_gnullvm]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_gnullvm]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_x86_64_gnullvm]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_msvc]]
version = "0.42.2"
criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_msvc]]
version = "0.48.5"
criteria = "safe-to-run"
[[exemptions.windows_x86_64_msvc]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.winnow]]
version = "0.5.40"
criteria = "safe-to-deploy"
[[exemptions.wireguard-uapi]]
version = "3.0.0"
criteria = "safe-to-deploy"
[[exemptions.x25519-dalek]]
version = "2.0.1"
criteria = "safe-to-deploy"
[[exemptions.zerocopy]]
version = "0.7.35"
criteria = "safe-to-deploy"
[[exemptions.zerocopy-derive]]
version = "0.7.35"
criteria = "safe-to-deploy"

1444
supply-chain/imports.lock Normal file

File diff suppressed because it is too large Load Diff