diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 19fc2c36..8e806ae6 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -4,6 +4,9 @@ [cargo-vet] version = "0.10" +[imports.bytecode-alliance] +url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml" + [imports.google] url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml" @@ -23,10 +26,6 @@ audit-as-crates-io = true version = "1.1.3" criteria = "safe-to-deploy" -[[exemptions.allocator-api2]] -version = "0.2.21" -criteria = "safe-to-deploy" - [[exemptions.arc-swap]] version = "1.7.1" criteria = "safe-to-deploy" @@ -43,10 +42,6 @@ criteria = "safe-to-deploy" version = "1.2.18" criteria = "safe-to-deploy" -[[exemptions.codespan-reporting]] -version = "0.12.0" -criteria = "safe-to-deploy" - [[exemptions.const-random]] version = "0.1.18" criteria = "safe-to-deploy" @@ -79,10 +74,6 @@ criteria = "safe-to-deploy" version = "0.8.21" criteria = "safe-to-deploy" -[[exemptions.crypto-common]] -version = "0.1.6" -criteria = "safe-to-deploy" - [[exemptions.ctor]] version = "0.4.2" criteria = "safe-to-deploy" @@ -151,10 +142,6 @@ criteria = "safe-to-run" version = "6.1.3" criteria = "safe-to-deploy" -[[exemptions.fastrand]] -version = "2.3.0" -criteria = "safe-to-run" - [[exemptions.fixedbitset]] version = "0.5.7" criteria = "safe-to-deploy" @@ -171,18 +158,10 @@ criteria = "safe-to-deploy" version = "0.14.5" criteria = "safe-to-deploy" -[[exemptions.hashbrown]] -version = "0.15.2" -criteria = "safe-to-deploy" - [[exemptions.hashlink]] version = "0.10.0" criteria = "safe-to-deploy" -[[exemptions.heck]] -version = "0.5.0" -criteria = "safe-to-deploy" - [[exemptions.indoc]] version = "2.0.6" criteria = "safe-to-deploy" @@ -383,10 +362,6 @@ criteria = "safe-to-deploy" version = "1.0.26" criteria = "safe-to-deploy" -[[exemptions.shlex]] -version = "1.3.0" -criteria = "safe-to-deploy" - [[exemptions.syn]] version = "2.0.106" criteria = "safe-to-deploy" @@ -395,10 +370,6 @@ criteria = "safe-to-deploy" version = "0.13.2" criteria = "safe-to-deploy" -[[exemptions.tempfile]] -version = "3.21.0" -criteria = "safe-to-run" - [[exemptions.termcolor]] version = "1.4.1" criteria = "safe-to-deploy" @@ -435,10 +406,6 @@ criteria = "safe-to-deploy" version = "0.1.7" criteria = "safe-to-deploy" -[[exemptions.unicase]] -version = "2.8.1" -criteria = "safe-to-deploy" - [[exemptions.unindent]] version = "0.2.4" criteria = "safe-to-deploy" @@ -590,7 +557,3 @@ criteria = "safe-to-deploy" [[exemptions.windows_x86_64_msvc]] version = "0.52.6" criteria = "safe-to-deploy" - -[[exemptions.wit-bindgen-rt]] -version = "0.39.0" -criteria = "safe-to-run" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 6cef060e..da64e6b6 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -22,6 +22,97 @@ user-id = 1139 user-login = "Manishearth" user-name = "Manish Goregaokar" +[[publisher.wit-bindgen-rt]] +version = "0.39.0" +when = "2025-02-05" +user-id = 73222 +user-login = "wasmtime-publish" + +[[audits.bytecode-alliance.wildcard-audits.wit-bindgen-rt]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +user-id = 73222 # wasmtime-publish +start = "2023-01-01" +end = "2026-06-03" +notes = """ +The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate +publication of this crate from CI. This repository requires all PRs are reviewed +by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself. +""" + +[[audits.bytecode-alliance.audits.allocator-api2]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +delta = "0.2.18 -> 0.2.20" +notes = """ +The changes appear to be reasonable updates from Rust's stdlib imported into +`allocator-api2`'s copy of this code. +""" + +[[audits.bytecode-alliance.audits.codespan-reporting]] +who = "Jamey Sharp " +criteria = "safe-to-deploy" +version = "0.11.1" +notes = "This library uses `forbid(unsafe_code)` and has no filesystem or network I/O." + +[[audits.bytecode-alliance.audits.crypto-common]] +who = "Benjamin Bouvier " +criteria = "safe-to-deploy" +version = "0.1.3" + +[[audits.bytecode-alliance.audits.fastrand]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.0.0 -> 2.0.1" +notes = """ +This update had a few doc updates but no otherwise-substantial source code +updates. +""" + +[[audits.bytecode-alliance.audits.fastrand]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.1.1 -> 2.3.0" +notes = "Minor refactoring, nothing new." + +[[audits.bytecode-alliance.audits.hashbrown]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +delta = "0.14.5 -> 0.15.2" + +[[audits.bytecode-alliance.audits.heck]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.4.1 -> 0.5.0" +notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected." + +[[audits.bytecode-alliance.audits.shlex]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "1.1.0" +notes = "Only minor `unsafe` code blocks which look valid and otherwise does what it says on the tin." + +[[audits.bytecode-alliance.audits.tempfile]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "3.16.0 -> 3.19.1" +notes = "Idiom and platform updates, but nothing major and nothing out of line." + +[[audits.bytecode-alliance.audits.tempfile]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "3.20.0 -> 3.21.0" +notes = "Only minor manifest/CI changes." + +[[audits.bytecode-alliance.audits.unicase]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "2.6.0" +notes = """ +This crate contains no `unsafe` code and no unnecessary use of the standard +library. +""" + [[audits.google.audits.autocfg]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -120,6 +211,16 @@ delta = "1.0.1 -> 1.0.2" notes = "No changes to any .rs files or Rust code." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.fastrand]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "1.9.0" +notes = """ +`does-not-implement-crypto` is certified because this crate explicitly says +that the RNG here is not cryptographically secure. +""" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + [[audits.google.audits.foldhash]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -171,6 +272,19 @@ criteria = "safe-to-run" delta = "0.2.14 -> 0.2.15" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.heck]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.4.1" +notes = """ +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` +and there were no hits. + +`heck` (version `0.3.3`) has been added to Chromium in +https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.indexmap]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -563,6 +677,12 @@ delta = "1.0.218 -> 1.0.219" notes = "Minor changes (clippy tweaks, using `mem::take` instead of `mem::replace`)." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.tempfile]] +who = "Ying Hsu " +criteria = "safe-to-run" +version = "3.10.1" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + [[audits.google.audits.unicode-ident]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -694,18 +814,61 @@ end = "2026-02-01" notes = "All code written or reviewed by Manish" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.allocator-api2]] +who = "Nicolas Silva " +criteria = "safe-to-deploy" +version = "0.2.18" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.allocator-api2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.20 -> 0.2.21" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.arraydeque]] who = "Lars Eggert " criteria = "safe-to-deploy" version = "0.5.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.codespan-reporting]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.11.1 -> 0.12.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.crunchy]] who = "Erich Gubler " criteria = "safe-to-deploy" version = "0.2.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.crypto-common]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.3 -> 0.1.6" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.fastrand]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.9.0 -> 2.0.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.fastrand]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "2.0.1 -> 2.1.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.fastrand]] +who = "Chris Martin " +criteria = "safe-to-deploy" +delta = "2.1.0 -> 2.1.1" +notes = "Fairly trivial changes, no chance of security regression." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.getrandom]] who = "Chris Martin " criteria = "safe-to-deploy" @@ -773,3 +936,29 @@ I didn't check the implementation thoroughly but there wasn't anything obviously which suggests no one else has found anything either. """ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.shlex]] +who = "Max Inden " +criteria = "safe-to-deploy" +delta = "1.1.0 -> 1.3.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.tempfile]] +who = "Chris Martin " +criteria = "safe-to-deploy" +delta = "3.10.1 -> 3.16.0" +notes = "Big change, but nothing unsafe and lots of it is documentation and convenience APIs" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.tempfile]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +delta = "3.19.1 -> 3.20.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.unicase]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.6.0 -> 2.8.1" +notes = "Update to Unicode 15.0.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"