loot/libloot
0
0
Fork 0
mirror of https://github.com/loot/libloot.git synced 2026-07-27 14:16:01 -07:00
Code Issues Packages Projects Releases Wiki Activity

Import Mozilla cargo-vet audits

Browse Source
This commit is contained in:
Oliver Hamlet
2025-09-28 19:06:30 +01:00
parent 5877527fda
commit 26d03282a6
2 changed files with 115 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supply-chain/config.toml
+3 -32
View File
@@ -7,6 +7,9 @@ version = "0.10"
[imports.google]
url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
[imports.mozilla]
url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
[policy.array-parameterized-test]
audit-as-crates-io = true
@@ -29,10 +32,6 @@ criteria = "safe-to-deploy"
version = "1.0.0"
criteria = "safe-to-deploy"
[[exemptions.arraydeque]]
version = "0.5.1"
criteria = "safe-to-deploy"
[[exemptions.block-buffer]]
version = "0.10.4"
criteria = "safe-to-deploy"
@@ -77,10 +76,6 @@ criteria = "safe-to-deploy"
version = "0.8.21"
criteria = "safe-to-deploy"
[[exemptions.crunchy]]
version = "0.2.3"
criteria = "safe-to-deploy"
[[exemptions.crypto-common]]
version = "0.1.6"
criteria = "safe-to-deploy"
@@ -145,10 +140,6 @@ criteria = "safe-to-deploy"
version = "0.0.5"
criteria = "safe-to-deploy"
[[exemptions.encoding_rs]]
version = "0.8.35"
criteria = "safe-to-deploy"
[[exemptions.errno]]
version = "0.3.11"
criteria = "safe-to-run"
@@ -193,10 +184,6 @@ criteria = "safe-to-deploy"
version = "0.5.0"
criteria = "safe-to-deploy"
[[exemptions.indexmap]]
version = "2.9.0"
criteria = "safe-to-deploy"
[[exemptions.indoc]]
version = "2.0.6"
criteria = "safe-to-deploy"
@@ -285,10 +272,6 @@ criteria = "safe-to-deploy"
version = "1.21.3"
criteria = "safe-to-deploy"
[[exemptions.option-ext]]
version = "0.2.0"
criteria = "safe-to-deploy"
[[exemptions.ordered-float]]
version = "5.0.0"
criteria = "safe-to-deploy"
@@ -389,10 +372,6 @@ criteria = "safe-to-deploy"
version = "0.21.1"
criteria = "safe-to-deploy"
[[exemptions.rustc-hash]]
version = "2.1.1"
criteria = "safe-to-deploy"
[[exemptions.rustix]]
version = "1.0.5"
criteria = "safe-to-run"
@@ -473,14 +452,6 @@ criteria = "safe-to-deploy"
version = "2.8.1"
criteria = "safe-to-deploy"
[[exemptions.unicode-segmentation]]
version = "1.12.0"
criteria = "safe-to-deploy"
[[exemptions.unicode-width]]
version = "0.2.0"
criteria = "safe-to-deploy"
[[exemptions.unindent]]
version = "0.2.4"
criteria = "safe-to-deploy"
supply-chain/imports.lock
+112
View File
@@ -1,6 +1,27 @@
# cargo-vet imports lock
[[publisher.encoding_rs]]
version = "0.8.35"
when = "2024-10-24"
user-id = 4484
user-login = "hsivonen"
user-name = "Henri Sivonen"
[[publisher.unicode-segmentation]]
version = "1.12.0"
when = "2024-09-13"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.unicode-width]]
version = "0.2.0"
when = "2024-09-19"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[audits.google.audits.autocfg]]
who = "Manish Goregaokar <manishearth@google.com>"
criteria = "safe-to-deploy"
@@ -125,6 +146,31 @@ delta = "0.1.4 -> 0.1.5"
notes = "No new `unsafe`."
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.indexmap]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
version = "2.7.1"
notes = '''
Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`
and there were no hits.
There is a little bit of `unsafe` Rust code - the audit can be found at
https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2
'''
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.indexmap]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
delta = "2.7.1 -> 2.8.0"
notes = """
No `unsafe` introduced or affected in:
* `indexmap_with_default!` and `indexset_with_default!` macros
* New `PartialEq` implementations
* `fn slice_eq` in `util.rs`
"""
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.num-traits]]
who = "Manish Goregaokar <manishearth@google.com>"
criteria = "safe-to-deploy"
@@ -541,3 +587,69 @@ criteria = "safe-to-deploy"
delta = "1.0.16 -> 1.0.18"
notes = "Only minor comment and documentation updates."
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.mozilla.wildcard-audits.encoding_rs]]
who = "Henri Sivonen <hsivonen@hsivonen.fi>"
criteria = "safe-to-deploy"
user-id = 4484 # Henri Sivonen (hsivonen)
start = "2019-02-26"
end = "2025-10-23"
notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-segmentation]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
user-id = 1139 # Manish Goregaokar (Manishearth)
start = "2019-05-15"
end = "2026-02-01"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-width]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
user-id = 1139 # Manish Goregaokar (Manishearth)
start = "2019-12-05"
end = "2026-02-01"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.arraydeque]]
who = "Lars Eggert <lars@eggert.org>"
criteria = "safe-to-deploy"
version = "0.5.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.crunchy]]
who = "Erich Gubler <erichdongubler@gmail.com>"
criteria = "safe-to-deploy"
version = "0.2.3"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.indexmap]]
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
criteria = "safe-to-deploy"
delta = "2.8.0 -> 2.9.0"
notes = "Doc update, a new API, one carefully annotated unsafe code block with all preconditions checked"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
[[audits.mozilla.audits.option-ext]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "0.2.0"
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
[[audits.mozilla.audits.rustc-hash]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.rustc-hash]]
who = "Ben Dean-Kawamura <bdk@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.1.0 -> 2.1.1"
notes = "Simple hashing crate, no unsafe code."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"