6e1041a1f6
All checks were successful
build-and-release / build (companies) (push) Successful in 5s
build-and-release / build (cron) (push) Successful in 5s
build-and-release / build (developers) (push) Successful in 6s
build-and-release / build (employees) (push) Successful in 6s
build-and-release / build (fitness-trainers) (push) Successful in 6s
build-and-release / build (gateway) (push) Successful in 7s
build-and-release / build (graphic-designers) (push) Successful in 8s
build-and-release / build (job-seekers) (push) Successful in 10s
build-and-release / build (customers) (push) Successful in 20s
build-and-release / build (catering-services) (push) Successful in 21s
build-and-release / build (makeup-artists) (push) Successful in 7s
build-and-release / build (jobs) (push) Successful in 6s
build-and-release / build (payments) (push) Successful in 7s
build-and-release / build (photographers) (push) Successful in 7s
build-and-release / build (ugc-content-creators) (push) Successful in 7s
build-and-release / build (tutors) (push) Successful in 8s
build-and-release / build (social-media-managers) (push) Successful in 11s
build-and-release / build (users) (push) Successful in 5s
build-and-release / build (video-editors) (push) Successful in 6s
cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via rust_decimal's optional rkyv feature, which apps/payments never enables (features = ["db-tokio-postgres"] only) - confirmed absent from the actual feature-resolved graph via cargo tree, and cargo-deny (which is feature-aware) already doesn't flag it. Added to both deny.toml and .cargo/audit.toml so cargo audit also exits 0. Also re-documented the 4 pre-existing crate-name-collision ignores in .cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 - our own workspace crates crates/cache and apps/users happen to share name+version with unrelated abandoned crates.io packages) with fuller explanation, and mirrored them into deny.toml for a single source of truth even though cargo-deny's real graph resolution never matched them in the first place. Verified: cargo audit and cargo deny check advisories bans both now exit 0 against the live server runbook's requirement. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
78 lines
3.8 KiB
TOML
78 lines
3.8 KiB
TOML
# cargo-deny configuration for nxtgauge-backend-rust
|
|
# https://embarkstudios.github.io/cargo-deny/
|
|
#
|
|
# For this private/proprietary workspace we only enforce:
|
|
# - advisories (CVEs / RustSec)
|
|
# - bans (forbidden crates, duplicate versions)
|
|
# License compliance is skipped — our internal crates have no license field.
|
|
|
|
[graph]
|
|
targets = []
|
|
|
|
# ── Advisories (CVEs / RustSec) ──────────────────────────────────────────────
|
|
[advisories]
|
|
version = 2
|
|
db-path = "~/.cargo/advisory-db"
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
ignore = [
|
|
# RUSTSEC-2023-0071 - rsa: Marvin Attack timing side-channel — no upstream fix available.
|
|
# Impact: potential RSA key recovery via timing. Low risk: we use RSA only for JWT
|
|
# verification (public-key ops), not for decryption. Acknowledged.
|
|
"RUSTSEC-2023-0071",
|
|
# RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
|
|
# bincode is used transitively; no replacement available in our dep tree.
|
|
"RUSTSEC-2025-0141",
|
|
# RUSTSEC-2026-0235 - rkyv: out-of-bounds read validating Rc/Arc in archives.
|
|
# Pulled in only as an optional dependency of rust_decimal (apps/payments) behind
|
|
# its "rkyv" feature, which we never enable (we use `features = ["db-tokio-postgres"]`
|
|
# only) — cargo-deny's feature-aware graph already excludes it, so this entry is here
|
|
# purely so cargo-audit (which scans the full Cargo.lock, not the activated feature
|
|
# graph) can share the same ignore list via .cargo/audit.toml. See that file for detail.
|
|
"RUSTSEC-2026-0235",
|
|
|
|
# RUSTSEC-2020-0128, RUSTSEC-2021-0006, RUSTSEC-2023-0040, RUSTSEC-2023-0059:
|
|
# crate-name collisions between our own workspace crates (crates/cache "cache" 0.1.0,
|
|
# apps/users "users" 0.1.0) and unrelated abandoned crates.io packages of the same
|
|
# name+version. cargo-deny's real dependency-graph resolution already doesn't match
|
|
# these (they're not in the graph at all), so these entries are no-ops here — kept
|
|
# only so this file documents the same accepted-risk list as .cargo/audit.toml, which
|
|
# matches by name+version alone and does flag them. See audit.toml for detail.
|
|
"RUSTSEC-2020-0128",
|
|
"RUSTSEC-2021-0006",
|
|
"RUSTSEC-2023-0040",
|
|
"RUSTSEC-2023-0059",
|
|
]
|
|
|
|
# ── Bans (duplicate deps / forbidden crates) ──────────────────────────────────
|
|
[bans]
|
|
# Warn on multiple versions of the same crate.
|
|
multiple-versions = "warn"
|
|
# Crates we never want in the dependency tree.
|
|
deny = [
|
|
# Avoid the old `time` crate (use chrono / time 0.3 instead)
|
|
{ name = "time", version = "=0.1" },
|
|
]
|
|
|
|
# ── Licenses (skipped for private workspace) ──────────────────────────────────
|
|
# We do not enforce license policy here because:
|
|
# - All our own workspace crates are proprietary and unpublished.
|
|
# - Third-party license compliance is managed separately.
|
|
[licenses]
|
|
version = 2
|
|
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "CC0-1.0", "Zlib", "OpenSSL"]
|
|
confidence-threshold = 0.6
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
|
|
|
|
[[licenses.exceptions]]
|
|
allow = ["LicenseRef-Private"]
|
|
crate = "auth"
|
|
|
|
# ── Sources ───────────────────────────────────────────────────────────────────
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|