From fadb4f2b9308009c8a4a1e2a71f6bb8a2a3e5ad4 Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Tue, 6 Jan 2026 21:26:46 +0000 Subject: [PATCH] Make a note of some cargo vet exemptions owned by rust-lang It's probably OK to trust the publishers in the future (cc is currently published using Trusted Publishing, hashbrown by the rust-lang-owner bot, and regex/regex-automata by burntsushi), since I've already got a trust relationship with rust-lang. --- supply-chain/config.toml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index be6cb155..51a5b8b7 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -39,6 +39,7 @@ criteria = "safe-to-deploy" [[exemptions.cc]] version = "1.2.18" criteria = "safe-to-deploy" +notes = "This crate's source repo is owned by the rust-lang GitHub org." [[exemptions.const-random]] version = "0.1.18" @@ -133,6 +134,7 @@ criteria = "safe-to-deploy" [[exemptions.hashbrown]] version = "0.14.5" criteria = "safe-to-deploy" +notes = "This crate's source repo is owned by the rust-lang GitHub org." [[exemptions.hashlink]] version = "0.10.0" @@ -269,10 +271,12 @@ notes = "At time of review this was only built if targeting Redox, which is not [[exemptions.regex]] version = "1.11.1" criteria = "safe-to-deploy" +notes = "This crate's source repo is owned by the rust-lang GitHub org." [[exemptions.regex-automata]] version = "0.4.9" criteria = "safe-to-deploy" +notes = "This crate's source repo is owned by the rust-lang GitHub org." [[exemptions.regress]] version = "0.10.4"