chore(ci): Enforce cargo-deny in CI #11761

epage · 2023-02-24T01:35:41Z

With #11448, we are pulling in a wide and deep dependency tree which makes it harder for us to track what we are pulling in over time.

I've been trying out cargo-deny on my projects and wanted to explore how useful it might be for cargo. atm I only have it configured to fail for unexpected licenses. We can also use its warnings to hunt down and remove duplicated dependencies to speed up our builds.

I did also enable advisories. We ignore the failure in a way to not block PRs or even show up as failure in PRs as PR authors are not responsible for dealing with these (unless its a new dep) and it can be intimidating as a contributor to see a failure and have no idea how to resolve it (as authors generally assume CI is green and failures are there fault)

I did not go too much further into what all cargo-deny can do; there might be more we can leverage.

We skip failure for advisories on the step, rather than the job, to not distract contributors in thinking they broke something as that bubbles up into the PR job summary.

rustbot · 2023-02-24T01:35:46Z

r? @ehuss

(rustbot has picked a reviewer for you, use r? to override)

epage · 2023-02-24T01:37:46Z

Dep duplication

curl's schannel and miow could update windows-sys
crypto_hash could update its hex

weihanglo

Looks good to me! Since it is a separate workflow, it should be no harm to integrate.

.github/workflows/audit.yml

epage · 2023-03-02T15:42:23Z

Example logs:

weihanglo · 2023-03-02T16:27:53Z

@rfcbot fcp merge

Just want to check there is no objection to the integration of cargo-deny. The tool does quite a few things:

Checks licenses of every direct/transitive dependencies.
Additional rules for banning dependencies
Checks dependencies against Rust Security Advisory Database.
Checks if the source of a dependency is permitted.

As this is a separate GitHub Actions workflow, it shouldn't block bors from merging pull requests. It's just the very first step of experimenting tools from the ecosystem.

rfcbot · 2023-03-02T16:27:54Z

Team member @weihanglo has proposed to merge this. The next step is review by the rest of the tagged team members:

No concerns currently listed.

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

rfcbot · 2023-03-02T17:34:49Z

🔔 This is now entering its final comment period, as per the review above. 🔔

psst @weihanglo, I wasn't able to add the final-comment-period label, please do so.

weihanglo · 2023-03-02T21:40:01Z

Looks good. We don't need to wait 10 days for FCP.

@bors r+

bors · 2023-03-02T21:40:03Z

📌 Commit f08bcd9 has been approved by weihanglo

It is now in the queue for this repository.

bors · 2023-03-02T21:40:11Z

⌛ Testing commit f08bcd9 with merge 5e76f34...

bors · 2023-03-02T22:40:41Z

☀️ Test successful - checks-actions
Approved by: weihanglo
Pushing 5e76f34 to master...

chore: Update base64 This removes one of cargo's duplicate dependencies as found by #11761. `base64` is a bit of a controversial crate right now. It is going through large API changes, making it not as ergonomic for basic cases, which has ticked off a number of people. I kept it for now because its elsewhere in our dependency tree. Byron already updated `prodash` to use the latest `parking_lot` Remaining duplicates - `hex` is blocked on `crypto-hash` which seems to no longer be maintained - `hashbrown` is blocked on `indexmap` (updated in master) and `imara-diff` - `humantime`, `env_logger`, `hermit-abi` are present from the optional `pretty_env_logger` dependency (why are we using optional deps? #6348) - `windows-sys` is held back by `schannel`, `tempfile`, and `mio`

23 commits in 9880b408a3af50c08fab3dbf4aa2a972df71e951..c1334b059c6dcceab3c10c81413f79bb832c8d9d 2023-02-28 19:39:39 +0000 to 2023-03-07 19:21:50 +0000 - Add `CARGO_PKG_README` (rust-lang/cargo#11645) - path dependency: fix cargo-util version (rust-lang/cargo#11807) - Adding display of which target failed to compile (rust-lang/cargo#11636) - Fix `CARGO_CFG_` vars for configs defined both with and without value (rust-lang/cargo#11790) - Breaking endless loop on cyclic features in added dependency in cargo-add (rust-lang/cargo#11805) - Enhance the doc of timing report with graphs (rust-lang/cargo#11798) - Make `sparse` the default protocol for crates.io (rust-lang/cargo#11791) - Use sha2 to calculate SHA256 (rust-lang/cargo#11795) - gitoxide progress bar fixes (rust-lang/cargo#11800) - Check publish_to_alt_registry publish content (rust-lang/cargo#11799) - chore: fix missing files in autolabel trigger_files (rust-lang/cargo#11797) - chore: Update base64 (rust-lang/cargo#11796) - Fix some doc typos (rust-lang/cargo#11794) - chore(ci): Enforce cargo-deny in CI (rust-lang/cargo#11761) - Some cleanup for unstable docs (rust-lang/cargo#11793) - gitoxide integration: fetch (rust-lang/cargo#11448) - patch can conflict on not activated packages (rust-lang/cargo#11770) - fix(toml): Provide a way to show unused manifest keys for dependencies (rust-lang/cargo#11630) - Improve error for missing crate in --offline mode for sparse index (rust-lang/cargo#11783) - feat(resolver): `-Zdirect-minimal-versions` (rust-lang/cargo#11688) - feat: Use test name for dir when running tests (rust-lang/cargo#11738) - Jobserver cleanup (rust-lang/cargo#11764) - Fix help string for "--charset" option of "cargo tree" (rust-lang/cargo#11785) Note that some 3rd-party licensing allowed list changed due to the introducion of `gix` dependency

Update cargo 25 commits in 9880b408a3af50c08fab3dbf4aa2a972df71e951..7d3033d2e59383fd76193daf9423c3d141972a7d 2023-02-28 19:39:39 +0000 to 2023-03-08 17:05:08 +0000 - Revert "rust-lang/cargo#11738" - Use test name for dir when running tests (rust-lang/cargo#11812) - Update CHANGELOG for 1.68 backports (rust-lang/cargo#11810) - Add `CARGO_PKG_README` (rust-lang/cargo#11645) - path dependency: fix cargo-util version (rust-lang/cargo#11807) - Adding display of which target failed to compile (rust-lang/cargo#11636) - Fix `CARGO_CFG_` vars for configs defined both with and without value (rust-lang/cargo#11790) - Breaking endless loop on cyclic features in added dependency in cargo-add (rust-lang/cargo#11805) - Enhance the doc of timing report with graphs (rust-lang/cargo#11798) - Make `sparse` the default protocol for crates.io (rust-lang/cargo#11791) - Use sha2 to calculate SHA256 (rust-lang/cargo#11795) - gitoxide progress bar fixes (rust-lang/cargo#11800) - Check publish_to_alt_registry publish content (rust-lang/cargo#11799) - chore: fix missing files in autolabel trigger_files (rust-lang/cargo#11797) - chore: Update base64 (rust-lang/cargo#11796) - Fix some doc typos (rust-lang/cargo#11794) - chore(ci): Enforce cargo-deny in CI (rust-lang/cargo#11761) - Some cleanup for unstable docs (rust-lang/cargo#11793) - gitoxide integration: fetch (rust-lang/cargo#11448) - patch can conflict on not activated packages (rust-lang/cargo#11770) - fix(toml): Provide a way to show unused manifest keys for dependencies (rust-lang/cargo#11630) - Improve error for missing crate in --offline mode for sparse index (rust-lang/cargo#11783) - feat(resolver): `-Zdirect-minimal-versions` (rust-lang/cargo#11688) - feat: Use test name for dir when running tests (rust-lang/cargo#11738) - Jobserver cleanup (rust-lang/cargo#11764) - Fix help string for "--charset" option of "cargo tree" (rust-lang/cargo#11785) --- ~~This update is primarily for making rust-lang/cargo#11630 into 1.69~~ (will file a beta backport then). However, just look into the licenses and dependencies permitted list, it looks a bit unfortunate but inevitable I guess? r? `@ehuss` cc `@Muscraft`

epage added 3 commits February 23, 2023 19:26

chore: Initialize cargo-deny

7b747de

chore: Match cargo-deny with current reality

aada2f3

chore(ci): Enforce cargo-deny in CI

f08bcd9

We skip failure for advisories on the step, rather than the job, to not distract contributors in thinking they broke something as that bubbles up into the PR job summary.

rustbot assigned ehuss Feb 24, 2023

rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Feb 24, 2023

weihanglo approved these changes Mar 2, 2023

View reviewed changes

.github/workflows/audit.yml Outdated Show resolved Hide resolved

.github/workflows/audit.yml Show resolved Hide resolved

.github/workflows/audit.yml Show resolved Hide resolved

.github/workflows/audit.yml Outdated Show resolved Hide resolved

weihanglo reviewed Mar 2, 2023

View reviewed changes

.github/workflows/audit.yml Outdated Show resolved Hide resolved

epage force-pushed the deny branch 6 times, most recently from cf828fd to f08bcd9 Compare March 2, 2023 15:42

epage marked this pull request as ready for review March 2, 2023 15:42

weihanglo added the T-cargo Team: Cargo label Mar 2, 2023

weihanglo added the final-comment-period FCP — a period for last comments before action is taken label Mar 2, 2023

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Mar 2, 2023

bors merged commit 5e76f34 into rust-lang:master Mar 2, 2023

epage mentioned this pull request Mar 2, 2023

chore: Update base64 #11796

Merged

epage deleted the deny branch March 3, 2023 14:57

weihanglo mentioned this pull request Mar 6, 2023

Update cargo rust-lang/rust#108665

Merged

ehuss added this to the 1.70.0 milestone Mar 9, 2023

rfcbot added finished-final-comment-period FCP complete to-announce and removed final-comment-period FCP — a period for last comments before action is taken labels Mar 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ci): Enforce cargo-deny in CI #11761

chore(ci): Enforce cargo-deny in CI #11761

epage commented Feb 24, 2023 •

edited

Loading

rustbot commented Feb 24, 2023

epage commented Feb 24, 2023 •

edited

Loading

weihanglo left a comment

epage commented Mar 2, 2023

weihanglo commented Mar 2, 2023 •

edited

Loading

rfcbot commented Mar 2, 2023 •

edited by ehuss

Loading

rfcbot commented Mar 2, 2023

weihanglo commented Mar 2, 2023

bors commented Mar 2, 2023

bors commented Mar 2, 2023

bors commented Mar 2, 2023

chore(ci): Enforce cargo-deny in CI #11761

chore(ci): Enforce cargo-deny in CI #11761

Conversation

epage commented Feb 24, 2023 • edited Loading

rustbot commented Feb 24, 2023

epage commented Feb 24, 2023 • edited Loading

weihanglo left a comment

Choose a reason for hiding this comment

epage commented Mar 2, 2023

weihanglo commented Mar 2, 2023 • edited Loading

rfcbot commented Mar 2, 2023 • edited by ehuss Loading

rfcbot commented Mar 2, 2023

weihanglo commented Mar 2, 2023

bors commented Mar 2, 2023

bors commented Mar 2, 2023

bors commented Mar 2, 2023

epage commented Feb 24, 2023 •

edited

Loading

epage commented Feb 24, 2023 •

edited

Loading

weihanglo commented Mar 2, 2023 •

edited

Loading

rfcbot commented Mar 2, 2023 •

edited by ehuss

Loading