cargo deny #34

New Issue

MrUnknownDE · 2026-04-05T20:29:02+02:00

MrUnknownDE commented

2026-04-05 20:29:02 +02:00

Originally created by @TriplEight on 3/22/2026

Add cargo-deny config for supply-chain checks.

Covers advisories (RustSec), license compliance, duplicate detection,
and source allowlist (crates.io only).

License allowlist reflects the full transitive dep tree: MIT, Apache-2.0,
ISC, BSD-*, 0BSD, Unlicense, Zlib, BSL-1.0, MPL-2.0, Unicode-3.0,
LGPL-2.1-or-later (r-efi, Windows-only), CDLA-Permissive-2.0 (webpki-roots).

Three known advisories are ignored:

RUSTSEC-2023-0071: rsa Marvin Attack, no upstream fix available
RUSTSEC-2025-0134: rustls-pemfile unmaintained, blocked on rustls upgrade
RUSTSEC-2026-0049: rustls-webpki CRL bug, fix blocked by rustls 0.21.x chain

Duplicate versions are warned rather than denied - all are transitive.

Run cargo deny in build workflow

Adds a cargo-deny step (EmbarkStudios/cargo-deny-action@v2)
after clippy and fmt, gated to the rust-toolchain matrix channel only.
Wires the outcome into the existing failure summary table.

*Originally created by @TriplEight on 3/22/2026* ## Add cargo-deny config for supply-chain checks. Covers advisories (RustSec), license compliance, duplicate detection, and source allowlist (crates.io only). License allowlist reflects the full transitive dep tree: MIT, Apache-2.0, ISC, BSD-*, 0BSD, Unlicense, Zlib, BSL-1.0, MPL-2.0, Unicode-3.0, LGPL-2.1-or-later (r-efi, Windows-only), CDLA-Permissive-2.0 (webpki-roots). Three known advisories are ignored: - RUSTSEC-2023-0071: rsa Marvin Attack, no upstream fix available - RUSTSEC-2025-0134: rustls-pemfile unmaintained, blocked on rustls upgrade - RUSTSEC-2026-0049: rustls-webpki CRL bug, fix blocked by rustls 0.21.x chain Duplicate versions are warned rather than denied - all are transitive. # Run cargo deny in build workflow Adds a cargo-deny step (EmbarkStudios/cargo-deny-action@v2) after clippy and fmt, gated to the rust-toolchain matrix channel only. Wires the outcome into the existing failure summary table.

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#34