docs: .cargo-checksum.json is not a security mechanism#16966
docs: .cargo-checksum.json is not a security mechanism#16966Muscraft merged 1 commit intorust-lang:masterfrom
.cargo-checksum.json is not a security mechanism#16966Conversation
|
r? @ehuss rustbot has assigned @ehuss. Use Why was this reviewer chosen?The reviewer was selected based on:
|
rustbot
added
A-documenting-cargo-itself
|
cc @emilyalbini |
There was a problem hiding this comment.
Thanks for doing this!
Since this was a request from wg-security-response, I think it would be best to wait for their review before merging to make sure they are happy with the wording and feel it will be helpful in reducing the false-positive report volume.
| the checksum of each file in the crate to protect against accidental | ||
| modifications. | ||
| Each crate in a directory source also has an associated metadata file | ||
| `.cargo-checksum.json` that only protects against accidental modifications. |
There was a problem hiding this comment.
I think it reads better as "Each crate in a directory source also has an associated metadata file .cargo-checksum.json to protect against accidental modifications."
(the word "only" seems unnecessary and it reads a bit oddly to me - I think mentioning "accidental" modification is enough of a qualifier to make the purpose clear)
There was a problem hiding this comment.
Updated. Thanks for the suggestion!
### What does this PR try to resolve? Clarify it only protects against accidental modifications and is not a security mechanism. Cargo doesn't set `deny_unknown_fields` on the [`Checksum`] struct, so older Cargo versions will just silently skip the `$comment` key. No backward compat issue. However, if external tools reject unknown fields they may have issues. Also, this add source diff churn when running `cargo vendor` between different toolchain versions even when dependencies have no changes. [`Checksum`]: https://github.com/rust-lang/cargo/blob/230e325f0b78128d6a005b8fa606b2854f5227db/src/cargo/sources/directory.rs#L68-L79 ### How to test and review this PR? cc rust-lang#16966 And see [#t-cargo > adding a comment on `.cargo-checksum.json`](https://rust-lang.zulipchat.com/#narrow/channel/246057-t-cargo/topic/adding.20a.20comment.20on.20.60.2Ecargo-checksum.2Ejson.60/with/593120043)
|
This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed. Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers. |
rustbot
removed
the
S-waiting-on-review
6 participants
What does this PR try to resolve?
In today's Cargo meeting, we agreed on adding at least a clarification on the
.cargo-checksum.jsonnot a security mechanism.See #t-cargo > adding a comment on `.cargo-checksum.json`
A PR adding an inline comment in
.cargo-checksum.jsonwill be submitted separately.