diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 2bc21302..3e9b16f1 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -7,6 +7,9 @@ version = "0.10" [imports.google] url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml" +[imports.mozilla] +url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml" + [policy.array-parameterized-test] audit-as-crates-io = true @@ -29,10 +32,6 @@ criteria = "safe-to-deploy" version = "1.0.0" criteria = "safe-to-deploy" -[[exemptions.arraydeque]] -version = "0.5.1" -criteria = "safe-to-deploy" - [[exemptions.block-buffer]] version = "0.10.4" criteria = "safe-to-deploy" @@ -77,10 +76,6 @@ criteria = "safe-to-deploy" version = "0.8.21" criteria = "safe-to-deploy" -[[exemptions.crunchy]] -version = "0.2.3" -criteria = "safe-to-deploy" - [[exemptions.crypto-common]] version = "0.1.6" criteria = "safe-to-deploy" @@ -145,10 +140,6 @@ criteria = "safe-to-deploy" version = "0.0.5" criteria = "safe-to-deploy" -[[exemptions.encoding_rs]] -version = "0.8.35" -criteria = "safe-to-deploy" - [[exemptions.errno]] version = "0.3.11" criteria = "safe-to-run" @@ -193,10 +184,6 @@ criteria = "safe-to-deploy" version = "0.5.0" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.9.0" -criteria = "safe-to-deploy" - [[exemptions.indoc]] version = "2.0.6" criteria = "safe-to-deploy" @@ -285,10 +272,6 @@ criteria = "safe-to-deploy" version = "1.21.3" criteria = "safe-to-deploy" -[[exemptions.option-ext]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.ordered-float]] version = "5.0.0" criteria = "safe-to-deploy" @@ -389,10 +372,6 @@ criteria = "safe-to-deploy" version = "0.21.1" criteria = "safe-to-deploy" -[[exemptions.rustc-hash]] -version = "2.1.1" -criteria = "safe-to-deploy" - [[exemptions.rustix]] version = "1.0.5" criteria = "safe-to-run" @@ -473,14 +452,6 @@ criteria = "safe-to-deploy" version = "2.8.1" criteria = "safe-to-deploy" -[[exemptions.unicode-segmentation]] -version = "1.12.0" -criteria = "safe-to-deploy" - -[[exemptions.unicode-width]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.unindent]] version = "0.2.4" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 01acf2b5..9d0beb21 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,27 @@ # cargo-vet imports lock +[[publisher.encoding_rs]] +version = "0.8.35" +when = "2024-10-24" +user-id = 4484 +user-login = "hsivonen" +user-name = "Henri Sivonen" + +[[publisher.unicode-segmentation]] +version = "1.12.0" +when = "2024-09-13" +user-id = 1139 +user-login = "Manishearth" +user-name = "Manish Goregaokar" + +[[publisher.unicode-width]] +version = "0.2.0" +when = "2024-09-19" +user-id = 1139 +user-login = "Manishearth" +user-name = "Manish Goregaokar" + [[audits.google.audits.autocfg]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -125,6 +146,31 @@ delta = "0.1.4 -> 0.1.5" notes = "No new `unsafe`." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.num-traits]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -541,3 +587,69 @@ criteria = "safe-to-deploy" delta = "1.0.16 -> 1.0.18" notes = "Only minor comment and documentation updates." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.mozilla.wildcard-audits.encoding_rs]] +who = "Henri Sivonen " +criteria = "safe-to-deploy" +user-id = 4484 # Henri Sivonen (hsivonen) +start = "2019-02-26" +end = "2025-10-23" +notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.unicode-segmentation]] +who = "Manish Goregaokar " +criteria = "safe-to-deploy" +user-id = 1139 # Manish Goregaokar (Manishearth) +start = "2019-05-15" +end = "2026-02-01" +notes = "All code written or reviewed by Manish" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.unicode-width]] +who = "Manish Goregaokar " +criteria = "safe-to-deploy" +user-id = 1139 # Manish Goregaokar (Manishearth) +start = "2019-12-05" +end = "2026-02-01" +notes = "All code written or reviewed by Manish" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.arraydeque]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +version = "0.5.1" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.crunchy]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +version = "0.2.3" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.indexmap]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.8.0 -> 2.9.0" +notes = "Doc update, a new API, one carefully annotated unsafe code block with all preconditions checked" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.option-ext]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +version = "0.2.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.rustc-hash]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +version = "1.1.0" +notes = "Straightforward crate with no unsafe code, does what it says on the tin." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.rustc-hash]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "1.1.0 -> 2.1.1" +notes = "Simple hashing crate, no unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"