From c19b0f4b1356b89703b5a52ce81d9b5280937c29 Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Sun, 28 Sep 2025 19:06:45 +0100 Subject: [PATCH] Import ISRG cargo-vet audits --- supply-chain/config.toml | 19 +----- supply-chain/imports.lock | 120 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 123 insertions(+), 16 deletions(-) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 3e9b16f1..19fc2c36 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -7,6 +7,9 @@ version = "0.10" [imports.google] url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml" +[imports.isrg] +url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml" + [imports.mozilla] url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml" @@ -164,10 +167,6 @@ criteria = "safe-to-deploy" version = "0.2.15" criteria = "safe-to-deploy" -[[exemptions.getrandom]] -version = "0.3.2" -criteria = "safe-to-run" - [[exemptions.hashbrown]] version = "0.14.5" criteria = "safe-to-deploy" @@ -344,14 +343,6 @@ criteria = "safe-to-deploy" version = "5.2.0" criteria = "safe-to-run" -[[exemptions.rayon]] -version = "1.11.0" -criteria = "safe-to-deploy" - -[[exemptions.rayon-core]] -version = "1.13.0" -criteria = "safe-to-deploy" - [[exemptions.redox_users]] version = "0.5.0" criteria = "safe-to-deploy" @@ -392,10 +383,6 @@ criteria = "safe-to-deploy" version = "1.0.26" criteria = "safe-to-deploy" -[[exemptions.sha2]] -version = "0.10.8" -criteria = "safe-to-deploy" - [[exemptions.shlex]] version = "1.3.0" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 9d0beb21..6cef060e 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -146,6 +146,31 @@ delta = "0.1.4 -> 0.1.5" notes = "No new `unsafe`." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.getrandom]] +who = "Android Legacy" +criteria = "safe-to-run" +version = "0.2.2" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.getrandom]] +who = "David Koloski " +criteria = "safe-to-deploy" +delta = "0.2.2 -> 0.2.12" +notes = "Audited at https://fxrev.dev/932979" +aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.getrandom]] +who = "Adrian Taylor " +criteria = "safe-to-run" +delta = "0.2.12 -> 0.2.14" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.getrandom]] +who = "danakj " +criteria = "safe-to-run" +delta = "0.2.14 -> 0.2.15" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.indexmap]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -588,6 +613,60 @@ delta = "1.0.16 -> 1.0.18" notes = "Only minor comment and documentation updates." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.isrg.audits.getrandom]] +who = "David Cook " +criteria = "safe-to-deploy" +delta = "0.3.1 -> 0.3.2" + +[[audits.isrg.audits.rayon]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.6.1 -> 1.7.0" + +[[audits.isrg.audits.rayon]] +who = "David Cook " +criteria = "safe-to-deploy" +delta = "1.7.0 -> 1.8.0" + +[[audits.isrg.audits.rayon]] +who = "Ameer Ghani " +criteria = "safe-to-deploy" +delta = "1.8.0 -> 1.8.1" + +[[audits.isrg.audits.rayon]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.8.1 -> 1.9.0" + +[[audits.isrg.audits.rayon]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.9.0 -> 1.10.0" + +[[audits.isrg.audits.rayon]] +who = "David Cook " +criteria = "safe-to-deploy" +delta = "1.10.0 -> 1.11.0" +notes = """ +I compared src/slice/sort.rs against the file library/core/src/slice/sort.rs +from the standard library, as of commit e501add. +""" + +[[audits.isrg.audits.rayon-core]] +who = "Ameer Ghani " +criteria = "safe-to-deploy" +version = "1.12.1" + +[[audits.isrg.audits.rayon-core]] +who = "David Cook " +criteria = "safe-to-deploy" +delta = "1.12.1 -> 1.13.0" + +[[audits.isrg.audits.sha2]] +who = "David Cook " +criteria = "safe-to-deploy" +version = "0.10.2" + [[audits.mozilla.wildcard-audits.encoding_rs]] who = "Henri Sivonen " criteria = "safe-to-deploy" @@ -627,6 +706,17 @@ criteria = "safe-to-deploy" version = "0.2.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.getrandom]] +who = "Chris Martin " +criteria = "safe-to-deploy" +delta = "0.2.15 -> 0.3.1" +notes = """ +I've looked over all unsafe code, and it appears to be safe, fully initializing the rng buffers. +In addition, I've checked Linux, Windows, Mac, and Android more thoroughly against API +documentation. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.indexmap]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy" @@ -640,6 +730,19 @@ criteria = "safe-to-deploy" version = "0.2.0" aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" +[[audits.mozilla.audits.rayon]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "1.5.3" +notes = "All code written or reviewed by Josh Stone or Niko Matsakis." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.rayon]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.5.3 -> 1.6.1" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.rustc-hash]] who = "Bobby Holley " criteria = "safe-to-deploy" @@ -653,3 +756,20 @@ criteria = "safe-to-deploy" delta = "1.1.0 -> 2.1.1" notes = "Simple hashing crate, no unsafe code." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.sha2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.10.2 -> 0.10.6" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.sha2]] +who = "Jeff Muizelaar " +criteria = "safe-to-deploy" +delta = "0.10.6 -> 0.10.8" +notes = """ +The bulk of this is https://github.com/RustCrypto/hashes/pull/490 which adds aarch64 support along with another PR adding longson. +I didn't check the implementation thoroughly but there wasn't anything obviously nefarious. 0.10.8 has been out for more than a year +which suggests no one else has found anything either. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"