ci: calibrer la porte supply-chain cargo-deny (triage advisories + licences)#2
Merged
Merged
Conversation
…ses)
First cargo-deny run was red; this makes it green honestly — verified locally
with cargo-deny 0.19.8: advisories ok, bans ok, licenses ok, sources ok.
Advisories (documented ignore list in deny.toml):
- 20 transitive `unmaintained` crates, no upstream fix (GTK3 bindings via Tauri,
proc-macro-error, paste, fxhash, unic-*, ...).
- 6 transitive vulnerabilities, upstream-pinned, each with id + reason:
- rustls-webpki 0.102.8 via libsql -> rustls 0.22: libsql is local-only (no
outbound HTTP), so the hyper-rustls/webpki TLS path is never exercised;
iroh's active TLS already uses patched 0.103.13. Real fix = bump libsql.
- hickory-proto/net via iroh's exact pin =0.26.0-beta.4 (DoS-class on DNS
discovery). Real fix = bump iroh.
Both upstream bumps are core-dep churn (iroh pulls pre-release der/pkcs8/spki),
deferred to a dedicated, tested PR.
Licenses: allow CDLA-Permissive-2.0 (Mozilla CA bundle via rustls/iroh).
CI: cargo-deny becomes the single advisory gate; drops the redundant cargo-audit
step (same RustSec DB, one ignore list, no drift).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
Le job Supply-chain de la CI (
ci.yml) était rouge dès le premier run decargo-deny. Cette PR le rend vert honnêtement — vérifié localement avec cargo-deny 0.19.8 :Triage des advisories (liste
ignoredocumentée dansdeny.toml)20 crates
unmaintainedtransitives, sans correctif amont — bindings GTK3 (gtk-rs) tirés par Tauri sur Linux,proc-macro-error,paste,fxhash,unic-*… Ce ne sont pas des vulnérabilités.6 vulnérabilités transitives, verrouillées en amont — chacune avec
id+reason+ évaluation d'exposition :rustls-webpki 0.102.8(RUSTSEC-2026-0049/0098/0099/0104) vialibsql → rustls 0.22. libsql est utilisé en LOCAL uniquement (l'app ne fait aucune requête HTTP sortante, cf.SECURITY.md) → le chemin TLShyper-rustls/webpkin'est jamais exercé. Le TLS actif (iroh QUIC) utilise déjàrustls-webpki 0.103.13(corrigé). Fix réel = bump libsql.hickory-proto/hickory-net(RUSTSEC-2026-0119/0120) via le pin exact d'iroh=0.26.0-beta.4(DoS sur la découverte DNS). Fix réel = bump iroh.Les deux bumps amont sont du churn de dépendances cœur (iroh 0.98.2 régresse
der/pkcs8/spkien pré-release) → reportés à une PR dédiée + testée, plutôt que bundlés ici.Licences
Autorise
CDLA-Permissive-2.0(bundle CA Mozilla via rustls/iroh, permissive).CI
cargo-denydevient la porte advisory unique ; suppression du stepcargo-auditredondant (même base RustSec, une seule liste d'ignore → pas de dérive).🤖 Generated with Claude Code