Add cargo-vet config

supply-chain/audits.toml

@@ -0,0 +1,88 @@
+
+# cargo-vet audits file
+
+[audits]
+
+[[trusted.esplugin]]
+criteria = "safe-to-deploy"
+user-id = 9999 # Oliver Hamlet (Ortham)
+start = "2019-04-24"
+end = "2026-09-16"
+notes = "I'm the author."
+
+[[trusted.libc]]
+criteria = "safe-to-deploy"
+user-id = 55123 # rust-lang-owner
+start = "2024-08-15"
+end = "2026-09-16"
+notes = "rust-lang-owner is a bot run by the Rust Infrastructure Team, so libc is hopefully as trustworthy as the Rust toolchain."
+
+[[trusted.windows-sys]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-11-15"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows-targets]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-09"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_aarch64_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-01"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_aarch64_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-11-05"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_i686_gnu]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-28"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_i686_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2024-04-02"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_i686_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-27"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_x86_64_gnu]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-28"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_x86_64_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-01"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."
+
+[[trusted.windows_x86_64_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-27"
+end = "2026-09-17"
+notes = "kennykerr is on the Windows team at Microsoft."

supply-chain/config.toml

@@ -0,0 +1,191 @@
+
+# cargo-vet config file
+
+[cargo-vet]
+version = "0.10"
+
+[imports.bytecode-alliance]
+url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml"
+
+[imports.esplugin]
+url = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
+
+[imports.google]
+url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
+
+[imports.isrg]
+url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"
+
+[imports.mozilla]
+url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
+
+[policy.loot-condition-interpreter]
+audit-as-crates-io = false
+
+[[exemptions.aho-corasick]]
+version = "1.1.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.crc32fast]]
+version = "1.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.criterion]]
+version = "0.7.0"
+criteria = "safe-to-run"
+
+[[exemptions.criterion-plot]]
+version = "0.6.0"
+criteria = "safe-to-run"
+
+[[exemptions.crossbeam-deque]]
+version = "0.8.6"
+criteria = "safe-to-run"
+
+[[exemptions.dataview]]
+version = "1.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_pod]]
+version = "0.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.errno]]
+version = "0.3.11"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.js-sys]]
+version = "0.3.77"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.linux-raw-sys]]
+version = "0.9.4"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.memchr]]
+version = "2.7.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.no-std-compat]]
+version = "0.4.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.nom]]
+version = "8.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.oorandom]]
+version = "11.1.5"
+criteria = "safe-to-run"
+
+[[exemptions.pelite]]
+version = "0.10.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.pelite-macros]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.plotters]]
+version = "0.3.7"
+criteria = "safe-to-run"
+
+[[exemptions.plotters-backend]]
+version = "0.3.7"
+criteria = "safe-to-run"
+
+[[exemptions.plotters-svg]]
+version = "0.3.7"
+criteria = "safe-to-run"
+
+[[exemptions.r-efi]]
+version = "5.2.0"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.regex]]
+version = "1.11.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex-automata]]
+version = "0.4.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustix]]
+version = "1.0.5"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.ryu]]
+version = "1.0.20"
+criteria = "safe-to-run"
+
+[[exemptions.syn]]
+version = "2.0.101"
+criteria = "safe-to-run"
+
+[[exemptions.walkdir]]
+version = "2.5.0"
+criteria = "safe-to-run"
+
+[[exemptions.wasi]]
+version = "0.14.2+wasi-0.2.4"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.wasm-bindgen]]
+version = "0.2.100"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.wasm-bindgen-backend]]
+version = "0.2.100"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.wasm-bindgen-macro]]
+version = "0.2.100"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.wasm-bindgen-macro-support]]
+version = "0.2.100"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.wasm-bindgen-shared]]
+version = "0.2.100"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.web-sys]]
+version = "0.3.77"
+criteria = "safe-to-run"
+suggest = false
+notes = "At time of review this was only built if targeting WASM, which is not an intended target."
+
+[[exemptions.winapi]]
+version = "0.3.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi-i686-pc-windows-gnu]]
+version = "0.4.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi-x86_64-pc-windows-gnu]]
+version = "0.4.0"
+criteria = "safe-to-deploy"