loot/libloot
0
0
Fork 0
mirror of https://github.com/loot/libloot.git synced 2026-07-27 14:16:01 -07:00
Code Issues Packages Projects Releases Wiki Activity

Import Bytecode Alliance cargo-vet audits

Browse Source
This commit is contained in:
Oliver Hamlet
2025-09-28 19:07:03 +01:00
parent c19b0f4b13
commit f79f68e03c
2 changed files with 192 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supply-chain/config.toml
+3 -40
View File
@@ -4,6 +4,9 @@
[cargo-vet]
version = "0.10"
[imports.bytecode-alliance]
url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml"
[imports.google]
url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
@@ -23,10 +26,6 @@ audit-as-crates-io = true
version = "1.1.3"
criteria = "safe-to-deploy"
[[exemptions.allocator-api2]]
version = "0.2.21"
criteria = "safe-to-deploy"
[[exemptions.arc-swap]]
version = "1.7.1"
criteria = "safe-to-deploy"
@@ -43,10 +42,6 @@ criteria = "safe-to-deploy"
version = "1.2.18"
criteria = "safe-to-deploy"
[[exemptions.codespan-reporting]]
version = "0.12.0"
criteria = "safe-to-deploy"
[[exemptions.const-random]]
version = "0.1.18"
criteria = "safe-to-deploy"
@@ -79,10 +74,6 @@ criteria = "safe-to-deploy"
version = "0.8.21"
criteria = "safe-to-deploy"
[[exemptions.crypto-common]]
version = "0.1.6"
criteria = "safe-to-deploy"
[[exemptions.ctor]]
version = "0.4.2"
criteria = "safe-to-deploy"
@@ -151,10 +142,6 @@ criteria = "safe-to-run"
version = "6.1.3"
criteria = "safe-to-deploy"
[[exemptions.fastrand]]
version = "2.3.0"
criteria = "safe-to-run"
[[exemptions.fixedbitset]]
version = "0.5.7"
criteria = "safe-to-deploy"
@@ -171,18 +158,10 @@ criteria = "safe-to-deploy"
version = "0.14.5"
criteria = "safe-to-deploy"
[[exemptions.hashbrown]]
version = "0.15.2"
criteria = "safe-to-deploy"
[[exemptions.hashlink]]
version = "0.10.0"
criteria = "safe-to-deploy"
[[exemptions.heck]]
version = "0.5.0"
criteria = "safe-to-deploy"
[[exemptions.indoc]]
version = "2.0.6"
criteria = "safe-to-deploy"
@@ -383,10 +362,6 @@ criteria = "safe-to-deploy"
version = "1.0.26"
criteria = "safe-to-deploy"
[[exemptions.shlex]]
version = "1.3.0"
criteria = "safe-to-deploy"
[[exemptions.syn]]
version = "2.0.106"
criteria = "safe-to-deploy"
@@ -395,10 +370,6 @@ criteria = "safe-to-deploy"
version = "0.13.2"
criteria = "safe-to-deploy"
[[exemptions.tempfile]]
version = "3.21.0"
criteria = "safe-to-run"
[[exemptions.termcolor]]
version = "1.4.1"
criteria = "safe-to-deploy"
@@ -435,10 +406,6 @@ criteria = "safe-to-deploy"
version = "0.1.7"
criteria = "safe-to-deploy"
[[exemptions.unicase]]
version = "2.8.1"
criteria = "safe-to-deploy"
[[exemptions.unindent]]
version = "0.2.4"
criteria = "safe-to-deploy"
@@ -590,7 +557,3 @@ criteria = "safe-to-deploy"
[[exemptions.windows_x86_64_msvc]]
version = "0.52.6"
criteria = "safe-to-deploy"
[[exemptions.wit-bindgen-rt]]
version = "0.39.0"
criteria = "safe-to-run"
supply-chain/imports.lock
+189
View File
@@ -22,6 +22,97 @@ user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.wit-bindgen-rt]]
version = "0.39.0"
when = "2025-02-05"
user-id = 73222
user-login = "wasmtime-publish"
[[audits.bytecode-alliance.wildcard-audits.wit-bindgen-rt]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
user-id = 73222 # wasmtime-publish
start = "2023-01-01"
end = "2026-06-03"
notes = """
The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate
publication of this crate from CI. This repository requires all PRs are reviewed
by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself.
"""
[[audits.bytecode-alliance.audits.allocator-api2]]
who = "Chris Fallin <chris@cfallin.org>"
criteria = "safe-to-deploy"
delta = "0.2.18 -> 0.2.20"
notes = """
The changes appear to be reasonable updates from Rust's stdlib imported into
`allocator-api2`'s copy of this code.
"""
[[audits.bytecode-alliance.audits.codespan-reporting]]
who = "Jamey Sharp <jsharp@fastly.com>"
criteria = "safe-to-deploy"
version = "0.11.1"
notes = "This library uses `forbid(unsafe_code)` and has no filesystem or network I/O."
[[audits.bytecode-alliance.audits.crypto-common]]
who = "Benjamin Bouvier <public@benj.me>"
criteria = "safe-to-deploy"
version = "0.1.3"
[[audits.bytecode-alliance.audits.fastrand]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "2.0.0 -> 2.0.1"
notes = """
This update had a few doc updates but no otherwise-substantial source code
updates.
"""
[[audits.bytecode-alliance.audits.fastrand]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "2.1.1 -> 2.3.0"
notes = "Minor refactoring, nothing new."
[[audits.bytecode-alliance.audits.hashbrown]]
who = "Chris Fallin <chris@cfallin.org>"
criteria = "safe-to-deploy"
delta = "0.14.5 -> 0.15.2"
[[audits.bytecode-alliance.audits.heck]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "0.4.1 -> 0.5.0"
notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected."
[[audits.bytecode-alliance.audits.shlex]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "Only minor `unsafe` code blocks which look valid and otherwise does what it says on the tin."
[[audits.bytecode-alliance.audits.tempfile]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "3.16.0 -> 3.19.1"
notes = "Idiom and platform updates, but nothing major and nothing out of line."
[[audits.bytecode-alliance.audits.tempfile]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
delta = "3.20.0 -> 3.21.0"
notes = "Only minor manifest/CI changes."
[[audits.bytecode-alliance.audits.unicase]]
who = "Alex Crichton <alex@alexcrichton.com>"
criteria = "safe-to-deploy"
version = "2.6.0"
notes = """
This crate contains no `unsafe` code and no unnecessary use of the standard
library.
"""
[[audits.google.audits.autocfg]]
who = "Manish Goregaokar <manishearth@google.com>"
criteria = "safe-to-deploy"
@@ -120,6 +211,16 @@ delta = "1.0.1 -> 1.0.2"
notes = "No changes to any .rs files or Rust code."
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.fastrand]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "1.9.0"
notes = """
`does-not-implement-crypto` is certified because this crate explicitly says
that the RNG here is not cryptographically secure.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.foldhash]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
@@ -171,6 +272,19 @@ criteria = "safe-to-run"
delta = "0.2.14 -> 0.2.15"
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.heck]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
version = "0.4.1"
notes = """
Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
and there were no hits.
`heck` (version `0.3.3`) has been added to Chromium in
https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
"""
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.indexmap]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
@@ -563,6 +677,12 @@ delta = "1.0.218 -> 1.0.219"
notes = "Minor changes (clippy tweaks, using `mem::take` instead of `mem::replace`)."
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
[[audits.google.audits.tempfile]]
who = "Ying Hsu <yinghsu@chromium.org>"
criteria = "safe-to-run"
version = "3.10.1"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.unicode-ident]]
who = "Lukasz Anforowicz <lukasza@chromium.org>"
criteria = "safe-to-deploy"
@@ -694,18 +814,61 @@ end = "2026-02-01"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.allocator-api2]]
who = "Nicolas Silva <nical@fastmail.com>"
criteria = "safe-to-deploy"
version = "0.2.18"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.allocator-api2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.20 -> 0.2.21"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.arraydeque]]
who = "Lars Eggert <lars@eggert.org>"
criteria = "safe-to-deploy"
version = "0.5.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.codespan-reporting]]
who = "Erich Gubler <erichdongubler@gmail.com>"
criteria = "safe-to-deploy"
delta = "0.11.1 -> 0.12.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.crunchy]]
who = "Erich Gubler <erichdongubler@gmail.com>"
criteria = "safe-to-deploy"
version = "0.2.3"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.crypto-common]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.3 -> 0.1.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.fastrand]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.9.0 -> 2.0.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.fastrand]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "2.0.1 -> 2.1.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.fastrand]]
who = "Chris Martin <cmartin@mozilla.com>"
criteria = "safe-to-deploy"
delta = "2.1.0 -> 2.1.1"
notes = "Fairly trivial changes, no chance of security regression."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Chris Martin <cmartin@mozilla.com>"
criteria = "safe-to-deploy"
@@ -773,3 +936,29 @@ I didn't check the implementation thoroughly but there wasn't anything obviously
which suggests no one else has found anything either.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.shlex]]
who = "Max Inden <mail@max-inden.de>"
criteria = "safe-to-deploy"
delta = "1.1.0 -> 1.3.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.tempfile]]
who = "Chris Martin <cmartin@mozilla.com>"
criteria = "safe-to-deploy"
delta = "3.10.1 -> 3.16.0"
notes = "Big change, but nothing unsafe and lots of it is documentation and convenience APIs"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.tempfile]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
delta = "3.19.1 -> 3.20.0"
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
[[audits.mozilla.audits.unicase]]
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
criteria = "safe-to-deploy"
delta = "2.6.0 -> 2.8.1"
notes = "Update to Unicode 15.0.0"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"