dfd3e2b360
Some checks failed
repo hygiene / hygiene (push) Has been cancelled
The Phase E commit message said deny-nigig-build.toml drops to 2 exemptions. It is 3, and the drop from 5 happened in Phase B, not E: Phase B removed the two polkit-derived advisories by dropping the unused robius-sms dependency from three manifests, and Phase E9 removed the dependency itself so they are now unreachable rather than unlisted. The three that remain (lopdf, ttf-parser, atomic-polyfill) are unrelated to SMS -- they arrive via printpdf and the embedded stack. Comment in the config now says so, so the next reader does not go looking for an SMS link that is not there.
282 lines
10 KiB
TOML
282 lines
10 KiB
TOML
# cargo-deny configuration for `nigig-build` (Phase 0.4).
|
|
#
|
|
# Separate from the root `deny.toml`, which governs the two payment crates
|
|
# and is deliberately much stricter. A shipped payment binary and a CAD
|
|
# editor do not warrant the same dependency policy, and collapsing them
|
|
# into one file would mean loosening the payment rules to accommodate a
|
|
# GUI dependency graph. That trade is not worth making.
|
|
#
|
|
# ## What this gates
|
|
#
|
|
# Security advisories and yanked crates, only. That is the check whose
|
|
# failure means something actionable.
|
|
#
|
|
# ## What this deliberately does not gate, and why
|
|
#
|
|
# `sources`: the graph pulls 126 crates from `gitdab.com/andodeki/makepad`
|
|
# and `github.com/project-robius`. Every one is pinned to an explicit rev
|
|
# (enforced by its own CI step), which is the property that actually
|
|
# matters. Turning these into 126 errors would produce a step that is
|
|
# always red, and an always-red step is ignored within a week.
|
|
#
|
|
# `bans`: multiple-versions is endemic to a Makepad + Robius graph and is
|
|
# not a defect on its own. The root config bans UI crates from the payment
|
|
# path; there is nothing analogous to ban here.
|
|
|
|
[graph]
|
|
all-features = true
|
|
|
|
[advisories]
|
|
version = 2
|
|
yanked = "deny"
|
|
|
|
ignore = [
|
|
# RUSTSEC-2026-0187 -- stack overflow in lopdf via deeply nested PDF
|
|
# objects. Reached only through printpdf 0.7 -> lopdf 0.31.
|
|
#
|
|
# Not exploitable here, verified rather than assumed: the advisory is
|
|
# about `Document::load*`, the PDF *parsing* entry points. This crate
|
|
# never parses a PDF. It writes them -- `arch_pdf.rs` builds documents
|
|
# through printpdf's drawing API and saves. There is no `lopdf` import
|
|
# anywhere in the workspace and no PDF read path of any kind.
|
|
#
|
|
# No upgrade exists in range: printpdf 0.7 pins lopdf 0.31, and
|
|
# `cargo update -p lopdf` moves nothing. Clearing it means moving to
|
|
# printpdf 0.8+, which is a breaking API change across all of
|
|
# arch_pdf.rs, or vendoring. Tracked as debt, not silently accepted.
|
|
#
|
|
# This ignore MUST be revisited the moment anything in this crate
|
|
# reads a PDF -- an import feature, a thumbnailer, a preview pane.
|
|
# At that point the input becomes untrusted and this is a real DoS:
|
|
# a ~21 KB file aborts the process with SIGABRT, and because it is a
|
|
# stack overflow rather than a panic, `catch_unwind` cannot save it.
|
|
"RUSTSEC-2026-0187",
|
|
|
|
# Unmaintained transitive dependencies. None has a safe upgrade, and
|
|
# none is reachable from a path this crate controls -- they arrive
|
|
# through the GUI/platform stack. Listed individually rather than
|
|
# blanket-disabling the `unmaintained` class, so a new one still
|
|
# fails the build and has to be looked at.
|
|
#
|
|
# RUSTSEC-2024-0370 (proc-macro-error) and RUSTSEC-2024-0429 (glib
|
|
# VariantStrIter unsoundness) were both listed here. Both arrived
|
|
# via glib <- gio <- polkit <- robius-sms, and robius-sms was a
|
|
# dependency this crate declared and never called -- zero references
|
|
# in nigig-build/src. It also reached here transitively through
|
|
# nigig-core and nigig-uikit, which likewise never used it.
|
|
#
|
|
# Removing those three declarations makes polkit, gio, glib and
|
|
# proc-macro-error unreachable from nigig-build, so both advisories
|
|
# are gone rather than accepted. Verified with
|
|
# cargo tree -p nigig-build -i polkit
|
|
# which no longer resolves. Do not re-add them without a caller.
|
|
#
|
|
# ttf-parser <- owned_ttf_parser <- printpdf
|
|
"RUSTSEC-2026-0192",
|
|
# atomic-polyfill <- transitive, embedded-oriented crate
|
|
"RUSTSEC-2023-0089",
|
|
#
|
|
# Phase B removed the two polkit-derived advisories from this list
|
|
# (5 -> 3) by dropping robius-sms from nigig-build, nigig-core and
|
|
# nigig-uikit. Phase E9 then removed the dependency itself: the
|
|
# robius-sms Linux backend declared polkit and gio but sys/linux.rs
|
|
# referenced neither -- every function returns
|
|
# PermanentlyUnavailable. That deleted polkit, gio, glib and
|
|
# proc-macro-error from Cargo.lock entirely (340 lines), so the two
|
|
# advisories are now unreachable rather than merely unlisted.
|
|
#
|
|
# The three below are unrelated to SMS: lopdf/ttf-parser arrive via
|
|
# printpdf, atomic-polyfill via the embedded stack.
|
|
]
|
|
|
|
[licenses]
|
|
version = 2
|
|
# Permissive licences. This list is the root config's, plus the ones the
|
|
# GUI graph actually pulls in -- each added after checking what needed it,
|
|
# not pre-emptively.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
# Public-domain-equivalent dedications. hexf-parse (CC0-1.0),
|
|
# quoted_printable (0BSD), tinyvec_macros (0BSD OR Unlicense).
|
|
"CC0-1.0",
|
|
"0BSD",
|
|
"Unlicense",
|
|
# webpki-roots. Mozilla's CA bundle, distributed under the CDLA
|
|
# permissive terms; data, not linked code.
|
|
"CDLA-Permissive-2.0",
|
|
]
|
|
confidence-threshold = 0.9
|
|
unused-allowed-license = "allow"
|
|
|
|
# First-party and vendored-fork crates carry no `license` field in their
|
|
# manifests. cargo-deny treats a missing field as "unlicensed" and fails.
|
|
#
|
|
# These are all crates this project or its upstream Makepad/Robius forks
|
|
# own, so there is no third-party licensing risk to assess -- but the
|
|
# manifests should still be fixed, and that is tracked separately rather
|
|
# than papered over here.
|
|
#
|
|
# Clarified individually, by name, instead of setting
|
|
# `unlicensed = "allow"`. The distinction matters: a NEW unlicensed crate
|
|
# entering the graph -- which would be a real finding -- still fails the
|
|
# build. The blanket setting would hide exactly the case worth catching.
|
|
#
|
|
# The expression asserts the Rust-ecosystem default these projects
|
|
# publish under. It is an assertion about crates we control, not a
|
|
# discovered fact; if any of them adopts a different licence, this must
|
|
# be updated to match.
|
|
|
|
# MPL-2.0 is weak copyleft, so it is granted to one named crate rather
|
|
# than added to `allow`. option-ext is a small path/directory helper
|
|
# reached through `dirs`. MPL's reciprocity is per-file: using it
|
|
# unmodified as a library imposes no obligation on this crate's own
|
|
# sources. If it is ever vendored and edited, those files must stay MPL
|
|
# and be published.
|
|
#
|
|
# Deliberately narrow. A future MPL crate on a different path gets its own
|
|
# decision instead of inheriting this one.
|
|
#
|
|
# NOTE: an entry here replaces the global `allow` list *for that crate*,
|
|
# so the crate's own licence must be spelled out in full. Getting this
|
|
# wrong is quiet -- it rejects rather than over-permits, but the error
|
|
# points at an unrelated crate.
|
|
[[licenses.exceptions]]
|
|
name = "option-ext"
|
|
allow = ["MPL-2.0"]
|
|
|
|
# polkit / polkit-sys are LGPL-2.1 bindings that used to be reached
|
|
# through robius-sms. Dynamic linking to LGPL from a distributed mobile
|
|
# binary was an open distribution question that needed a deliberate
|
|
# answer before any store release.
|
|
#
|
|
# It is now CLOSED workspace-wide, in two steps:
|
|
# Phase B removed robius-sms from nigig-build, nigig-core and
|
|
# nigig-uikit, none of which called it.
|
|
# Phase E9 deleted robius-sms's own [target.linux] dependencies, since
|
|
# sys/linux.rs referenced neither polkit nor gio -- every
|
|
# function there returns PermanentlyUnavailable.
|
|
#
|
|
# polkit, polkit-sys, gio and glib no longer appear in Cargo.lock at all,
|
|
# so there is no LGPL-2.1 linkage to answer for and no advisory to
|
|
# accept. This note stays as the record of why.
|
|
|
|
[bans]
|
|
multiple-versions = "allow"
|
|
# cargo-deny counts a git dependency as a "wildcard" because it carries no
|
|
# semver requirement. Every one here is pinned to a full 40-character rev,
|
|
# which is strictly stronger than a version range, and a dedicated CI step
|
|
# already enforces that. Denying wildcards would fail on the pinning we
|
|
# deliberately chose.
|
|
wildcards = "allow"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
# Not "deny": see the header. Git sources are governed by the rev-pinning
|
|
# CI step instead, which is the check that actually protects the build.
|
|
unknown-git = "allow"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
|
|
[[licenses.clarify]]
|
|
name = "doc-engine"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-boolean"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-exact"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-math"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-mesh"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-primitives"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-csg-sdf"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-fast-inflate"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-git"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-latex-math"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "makepad-regex"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "matrix_client"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "nigig-build"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "nigig-core"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "nigig-uikit"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "robius-contacts"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
# robius-sms no longer needs a clarify entry: Phase E10 added an explicit
|
|
# `license = "MIT OR Apache-2.0"` to its manifest.
|
|
|
|
[[licenses.clarify]]
|
|
name = "spreadsheet-engine"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|
|
|
|
[[licenses.clarify]]
|
|
name = "spreadsheet-ui"
|
|
expression = "MIT OR Apache-2.0"
|
|
license-files = []
|