chore: Ignore rust advisory RUSTSEC-2023-0089

error[unmaintained]: atomic-polyfill is unmaintained
   ┌─ /github/workspace/Cargo.lock:15:1
   │
15 │ atomic-polyfill 1.0.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2023-0089
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0089
   ├ The author has archived the GitHub repository and mentions deprecation in
     project's
     [README](48e55c1666/README.md).

     ## Possible alternatives

      * [portable-atomic](https://crates.io/crates/portable-atomic)
   ├ Announcement: 48e55c1666
   ├ Solution: No safe upgrade is available!
   ├ atomic-polyfill v1.0.3
     └── heapless v0.7.17
         ├── aead v0.5.2
         │   └── chacha20poly1305 v0.10.1
         │       └── rosenpass-ciphers v0.1.0
         │           ├── rosenpass v0.3.0-dev
         │           │   ├── rosenpass-fuzzing v0.0.1
         │           │   └── rp v0.2.1
         │           ├── rosenpass-fuzzing v0.0.1 (*)
         │           └── rp v0.2.1 (*)
         └── postcard v1.1.1
             └── rosenpass-wireguard-broker v0.1.0
                 ├── rosenpass v0.3.0-dev (*)
                 └── rp v0.2.1 (*)

.github/workflows/cargo-crev-exemptions-dependabot.yml

@@ -1,58 +0,0 @@
-name: Dependabot Vet Exemptions
-on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-
-jobs:
-  dependabot-cargo-crev-exceptions:
-    if: github.actor == 'dependabot[bot]' # Run only for Dependabot PRs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          token: ${{ secrets.GITHUB_TOKEN }} # Ensure push access
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-          key: cargo-vet-cache
-
-      - name: Install stable toolchain # Since we are running/compiling cargo-vet, we should rely on the stable toolchain.
-        run: |
-          rustup toolchain install stable
-          rustup default stable
-
-      - uses: actions/cache@v4
-        with:
-          path: ${{ runner.tool_cache }}/cargo-vet
-          key: cargo-vet-bin
-
-      - name: Add the tool cache directory to the search path
-        run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
-
-      - name: Ensure that the tool cache is populated with the cargo-vet binary
-        run: cargo install --root ${{ runner.tool_cache }}/cargo-vet cargo-vet
-
-      - name: Regenerate vet exemptions
-        run: cargo vet regenerate exemptions
-
-      - name: Check for changes
-        run: git diff --exit-code || echo "Changes detected, committing..."
-
-      - name: Commit and push changes
-        if: success()
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions@github.com"
-          git add supply-chain./*
-          git commit -m "Regenerate cargo vet exemptions"
-          git push origin ${{ github.head_ref }}

.github/workflows/manual-mac-pr.yaml

@@ -0,0 +1,19 @@
+name: PR Validation on Mac
+on:
+  workflow_dispatch:
+permissions:
+  checks: write
+  contents: write
+concurrency:
+  group: manual-mac-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  qc:
+    uses: ./.github/workflows/qc-mac.yaml
+    permissions:
+      checks: write
+      contents: read
+  nix:
+    uses: ./.github/workflows/nix-mac.yaml
+    permissions:
+      contents: write

.github/workflows/nix-mac.yaml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - main
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/qc-mac.yaml

@@ -1,7 +1,8 @@
-name: QC
+name: QC Mac
 on:
   push:
     branches: [main]
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -12,7 +13,7 @@ permissions:
   contents: read
 
 jobs:
-  cargo-test:
+  cargo-test-mac:
     runs-on: warp-macos-13-arm64-6x
     steps:
       - uses: actions/checkout@v4

.github/workflows/qc.yaml

@@ -159,6 +159,7 @@ jobs:
 
   cargo-fuzz:
     runs-on: ubicloud-standard-2-ubuntu-2204
+    env:
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -173,7 +174,7 @@ jobs:
       - name: Install nightly toolchain
         run: |
           rustup toolchain install nightly
-          rustup default nightly
+          rustup override nightly
       - name: Install cargo-fuzz
         run: cargo install cargo-fuzz
       - name: Run fuzzing
@@ -209,4 +210,5 @@ jobs:
           files: ./target/grcov/lcov
           verbose: true
         env:
+          RUSTUP_TOOLCHAIN: 1.81
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/supply-chain.yml

@@ -46,6 +46,8 @@ jobs:
   cargo-vet:
     name: Vet Dependencies
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
@@ -67,5 +69,23 @@ jobs:
         run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
       - name: Ensure that the tool cache is populated with the cargo-vet binary
         run: cargo install --root ${{ runner.tool_cache }}/cargo-vet cargo-vet
+      - name: Regenerate vet exemptions for dependabot PRs
+        if: github.actor == 'dependabot[bot]' # Run only for Dependabot PRs
+        run: cargo vet regenerate exemptions
+      - name: Check for changes in case of dependabot PR
+        if: github.actor == 'dependabot[bot]' # Run only for Dependabot PRs
+        run: git diff --exit-code || echo "Changes detected, committing..."
+      - name: Commit and push changes for dependabot PRs
+        if: success() && github.actor == 'dependabot[bot]'
+        run: |
+          git fetch origin ${{ github.head_ref }}
+          git switch ${{ github.head_ref }}
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions@github.com"
+          git add supply-chain/*
+          git commit -m "Regenerate cargo vet exemptions"
+          git push origin ${{ github.head_ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Invoke cargo-vet
         run: cargo vet --locked

Cargo.lock

@@ -500,9 +500,9 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
  "crossbeam-utils",
 ]

cipher-traits/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal traits for cryptographic primitives"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [dependencies]
 thiserror = { workspace = true }

ciphers/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal ciphers and other cryptographic primitives use
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [features]
 experiment_libcrux_all = [

constant-time/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal utilities for constant time crypto implementat
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

deny.toml

@@ -27,6 +27,7 @@ feature-depth = 1
 ignore = [
     "RUSTSEC-2024-0370",
     "RUSTSEC-2024-0436",
+    "RUSTSEC-2023-0089",
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.

flake.nix

@@ -129,6 +129,7 @@
             nativeBuildInputs = with pkgs; [
               cargo-audit
               cargo-release
+              cargo-msrv
               rustfmt
               nodePackages.prettier
               nushell # for the .ci/gen-workflow-files.nu script

fuzz/Cargo.toml

@@ -3,6 +3,7 @@ name = "rosenpass-fuzzing"
 version = "0.0.1"
 publish = false
 edition = "2021"
+rust-version = "1.77"
 
 [features]
 experiment_libcrux = ["rosenpass-ciphers/experiment_libcrux_all"]

oqs/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal bindings to liboqs"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [dependencies]
 rosenpass-cipher-traits = { workspace = true }

rosenpass/Cargo.toml

@@ -8,6 +8,7 @@ description = "Build post-quantum-secure VPNs with WireGuard!"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [[bin]]
 name = "rosenpass"

rp/Cargo.toml

@@ -6,6 +6,7 @@ license = "MIT OR Apache-2.0"
 description = "Build post-quantum-secure VPNs with WireGuard!"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
+rust-version = "1.77"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "1.77.0"

secret-memory/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal utilities for storing secrets in memory"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [dependencies]
 anyhow = { workspace = true }

supply-chain/imports.lock

@@ -1344,6 +1344,13 @@ criteria = "safe-to-deploy"
 delta = "0.5.13 -> 0.5.14"
 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.crossbeam-channel]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.14 -> 0.5.15"
+notes = "Fixes a regression from an earlier version which could lead to a double free"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.crunchy]]
 who = "Erich Gubler <erichdongubler@gmail.com>"
 criteria = "safe-to-deploy"

to/Cargo.toml

@@ -8,6 +8,7 @@ description = "Flexible destination parameters"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [dev-dependencies]
 doc-comment = { workspace = true }

util/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal utilities"
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

util/src/time.rs

@@ -13,7 +13,7 @@ use std::time::Instant;
 ///
 /// let timebase = Timebase::default();
 /// let now = timebase.now();
-/// assert!(now > 0.0);
+/// assert!(now >= 0.0);
 /// ```
 
 #[derive(Clone, Debug)]

wireguard-broker/Cargo.toml

@@ -8,6 +8,7 @@ description = "Rosenpass internal broker that runs as root and supplies exchange
 homepage = "https://rosenpass.eu/"
 repository = "https://github.com/rosenpass/rosenpass"
 readme = "readme.md"
+rust-version = "1.77"
 
 [dependencies]
 thiserror = { workspace = true }