4.0 KiB
Supply Chain Protection
The CI for this repository uses the following tools to protect the supply chain:
- cargo-vet: vets dependencies based on existing audits with the aim of incrementally using fewer and fewer unaudited dependencies.
- cargo-deny: checks for unwanted licenses, crates, and other security issues.
- cargo-supply-chain: generates reports on dependencies and their authors.
Below, we briefly explain how to configure these tools and how to make appropriate adjustments when dependencies change.
cargo-vet
cargo-vet vets dependencies based on performed audits. In order to avoid redundant work, it encourages the use of already
performed audits by trusted organizations or people. As of now, we trust audits performed by the
actix team, the bytecode-alliance
embark-studios,
fermyon,
google,
the ISRG,
the mozilla team,
and the ZCash foundaton.
Since, as of now, only a minority of crates have been audited, the tool aims at incrementally using fewer and fewer unaudited dependencies by initially exempting all dependencies
from the need to be audited for the CI to pass. When more and more crates are audited, the tool prompts to reevaluate
the list of exemptions and remove as many as possible.
Configuration
The configuration files for cargo-vet are located in the supply-chain directory. The central configuration file is
config.toml, where the lst of trusted organizations and the list of exemptions are defined.
Adding new dependencies
Make sure to install cargo vet first.
Then, when adding new dependencies, run cargo vet suggest before committing. If the dependency is not safe-to-deploy,
add it to the exemptions in the file supply-chain/config.toml.
For all further configration options, please refer to the cargo-vet documentation.
cargo-deny
cargo-deny checks for unwanted licenses, crates, and other security issues. It is configured in the file deny.toml.
Licenses
The only allowed licenses are the MIT license, the Apache-2.0 license, Apache-2.0 license WITH LLVM-exception,
BSD-3-Clause license and the ISC license. All other licenses are banned. An exception is made for the
unicode-ident-crate, for which we allow the Unicode-DFS-2016 license.
Security vulnerabilities
The tool checks for security vulnerabilities in dependencies. If a vulnerability is found, the CI will fail. If you must,
you can add exceptions in the deny.toml file, but this should only be a last resort.
Adding new dependencies
Make sure to install cargo deny first. Then, when adding new dependencies,
run cargo deny check before committing. If there are issues wth the dependency reported by cargo deny check, you
should try to resolve it appropriately. If this is not possible thoroughly consider if the dependency is necessary and
an exception should be made in the deny.toml file.
For all further configration options, please refer to the cargo-deny documentation.
cargo-supply-chain
cargo-supply-chain generates reports on dependencies and their authors. These reports should be reviewed regularly.
However, they will not cause the CI to fail.