80c3f578dd
Some checks failed
Blocked since Phase 0 because cargo-deny resolves from the lockfile, and unblocked once Cargo.lock was committed in 0.2. I predicted this would surface a large backlog. It did: 5 advisories, 6 licence rejections, 126 git-source errors and 20 unlicensed crates. The triage is the work here, not the config. ONE ACTUAL VULNERABILITY. RUSTSEC-2026-0187: unbounded recursion parsing nested PDF objects in lopdf 0.31, reached via printpdf 0.7. A ~21 KB crafted file aborts the process with SIGABRT, and because it is a stack overflow rather than a panic, catch_unwind cannot contain it. Not exploitable here, and I checked rather than assumed. The advisory is specifically about Document::load*, the parsing entry points. This crate never parses a PDF -- arch_pdf.rs only writes them through printpdf's drawing API, there is no lopdf import anywhere in the workspace, and there is no PDF read path of any kind. There is also no fix in range: printpdf 0.7 pins lopdf 0.31 and `cargo update -p lopdf` moves nothing. Clearing it means printpdf 0.8+, a breaking change across arch_pdf.rs. So it is ignored with the reasoning written down AND with the condition that invalidates it: the moment anything in this crate reads a PDF -- an import feature, a thumbnailer, a preview pane -- this becomes a live DoS and the ignore must go. An ignore without its expiry condition is how real vulnerabilities get inherited. The other four advisories are unmaintained/unsound transitive crates (proc-macro-error, ttf-parser, atomic-polyfill, glib VariantStrIter), none with a safe upgrade, all arriving through the GUI/platform stack. Listed individually rather than disabling the unmaintained class, so a new one still fails. Six licence rejections were permissive licences simply absent from the allow list. MPL-2.0 (option-ext) is weak copyleft, so it is granted to that one crate rather than added globally -- MPL reciprocity is per-file and only bites if the crate is vendored and edited. The 126 git-source errors and 20 unlicensed crates are artifacts, not findings. Every git dependency is pinned to a full rev, which is stronger than a version range and already enforced by its own CI step; the unlicensed crates are first-party and vendored forks with no license field. Both handled WITHOUT allow-ing the class: sources are governed by the rev-pinning step, and the 20 crates are clarified by name, so a genuinely new unlicensed dependency still fails. Blanket-disabling would have hidden exactly the case worth catching. Separate file from deny.toml on purpose. Merging them would mean loosening the payment rules to fit a Makepad + Robius graph, and the payment policy is the one worth keeping tight. Verified both pay crates still pass unchanged. Negative-tested in both directions: removing the lopdf ignore fails the gate, and removing MIT from the allow list produces 79 rejections. A gate that cannot fail is worse than no gate. 622 lib + 154 integration, 0 failed.
58 lines
1.8 KiB
TOML
58 lines
1.8 KiB
TOML
# cargo-deny configuration (review item 1.2: dependency audit, deny and
|
|
# license checks).
|
|
#
|
|
# Scope: the two crates that own the payment path, `nigig-pay-domain` and
|
|
# `nigig-pay-storage`. This file is deliberately strict -- a shipped payment
|
|
# binary justifies rules a GUI app does not.
|
|
#
|
|
# `nigig-build` is covered separately by `deny-nigig-build.toml` (Phase 0.4).
|
|
# It is a separate file rather than a shared one on purpose: merging them
|
|
# would mean loosening these rules to accommodate a Makepad + Robius
|
|
# dependency graph, and the payment policy is the one worth keeping tight.
|
|
|
|
[graph]
|
|
all-features = true
|
|
|
|
[advisories]
|
|
# Fail on any security advisory affecting the payment dependency graph.
|
|
version = 2
|
|
yanked = "deny"
|
|
ignore = []
|
|
|
|
[licenses]
|
|
version = 2
|
|
# Permissive licences only. A copyleft dependency in a shipped mobile payment
|
|
# binary is a distribution question that must be answered deliberately, not
|
|
# discovered at release time.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
]
|
|
confidence-threshold = 0.9
|
|
# Allowances that the current graph does not exercise are listed deliberately
|
|
# as headroom for review, so they must not fail the build.
|
|
unused-allowed-license = "allow"
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
wildcards = "deny"
|
|
# A payment crate must not pull in a UI framework. This is the machine-checked
|
|
# form of review item 1.4.
|
|
deny = [
|
|
{ name = "makepad-widgets" },
|
|
{ name = "makepad-draw" },
|
|
{ name = "makepad-platform" },
|
|
]
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
# Only crates.io. A git dependency in the payment path would bypass the
|
|
# lockfile-plus-audit guarantee this configuration exists to provide.
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|