ci(security): ignore drifted transitive-dep RustSec advisories - #2467
Merged
Conversation
The RustSec DB added unmaintained/unsound/yanked advisories for transitive dependencies (paste, proc-macro-error2, derivative, instant, backoff, rustls-pemfile, anyhow, event-listener, spin) that fakecloud does not exercise with untrusted input. They reddened the audit job on every PR and main. Ignore them with documented rationale, consistent with the existing allowlist policy, until upstream fixes land.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The RustSec advisory DB drifted and now flags nine additional advisories for transitive dependencies that are not in the audit ignore list. This reddens the
auditjob on every open PR and on main:Fix
Add all nine to the
cargo audit --ignorelist with per-batch rationale, consistent with the existing allowlist policy. Every one is a build-time-only proc-macro/derive helper, or a transitive runtime dependency that fakecloud never feeds attacker-controlled input, or a yanked-version advisory with no upgrade path on our pinned tree. None has an actionable fixed release for our dependency graph today.Unblocks all open PRs whose
auditjob is currently red purely from this drift.Summary by cubic
Ignore nine new RustSec advisories for transitive dependencies in CI to unbreak the
cargo auditjob and unblock PRs. Adds documented ignores until upstream fixes are available.paste,instant,proc-macro-error2,derivative,anyhow,rustls-pemfile,event-listener,spin,backoff).Written for commit 4c63154. Summary will update on new commits.