From 754f908e69f670ec42094bd3148af767254d91df Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 2 Aug 2026 03:15:40 +0800 Subject: [PATCH 1/2] fix(supply-chain): trust protobuf-forensic-core as ours instead of exempting it ADR-0018 ranks the four cargo-vet mechanisms and states that reaching for a weaker one is a defect. These crates are ours, consumed from crates.io, so case 2 applies: a publisher-trust entry under h4x0r (user-id 347968), not an exemption. The distinction is semantic, not cosmetic. An exemption asserts "unreviewed, accepted anyway"; a trust entry asserts "the publisher is ours". Recording our own crates as unreviewed-but-tolerated misstated the supply-chain posture in the direction of false comfort. A trust entry is also version-agnostic, so it does not go stale on the next bump the way a pinned exemption does. Exemption -> trust: - protobuf-forensic-core Verified (config change, so the vet run is the test): Vetting Succeeded (13 fully audited, 53 exempted) Co-Authored-By: Claude Opus 5 (1M context) --- supply-chain/audits.toml | 6 ++++++ supply-chain/config.toml | 4 ---- supply-chain/imports.lock | 7 +++++++ 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2772ccb..7b4a642 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2,3 +2,9 @@ # cargo-vet audits file [audits] + +[[trusted.protobuf-forensic-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-11" +end = "2027-08-01" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 7c98491..bcbf937 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -131,10 +131,6 @@ criteria = "safe-to-deploy" version = "1.0.107" criteria = "safe-to-deploy" -[[exemptions.protobuf-forensic-core]] -version = "0.1.1" -criteria = "safe-to-deploy" - [[exemptions.quick-xml]] version = "0.41.0" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index e2c8bf5..d2e93cb 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -8,6 +8,13 @@ user-id = 696 user-login = "fitzgen" user-name = "Nick Fitzgerald" +[[publisher.protobuf-forensic-core]] +version = "0.1.1" +when = "2026-07-25" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[audits.bytecode-alliance.wildcard-audits.bumpalo]] who = "Nick Fitzgerald " criteria = "safe-to-deploy" From e2a40caf127a93355847b09b4dd872b0a4b17dd8 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 06:20:45 -0700 Subject: [PATCH 2/2] chore(deps): refresh Cargo.lock so `freshness` reflects reality The `freshness` job is literally `cargo update --locked`: it fails when the committed lockfile trails what the manifests already permit. It was failing for exactly that reason -- the lock was three releases behind: clap 4.6.4 -> 4.6.6 clap_builder 4.6.2 -> 4.6.6 time 0.3.54 -> 0.3.55 Refreshed the lock and re-stated the cargo-vet exemptions for the three moved versions. This is bookkeeping, not a supply-chain decision: an exemption asserts "nobody audited this", which is equally true before and after a version bump. Verified the crate NAME set did not grow -- no dependency that was not already shipping is now shipping (indexmap dropped out; nothing new entered). Verification, all on this branch: cargo update --locked exit 0 (was 101) cargo test --workspace --all-features pass, 0 failed cargo deny check advisories/bans/licenses/sources ok cargo vet --locked Succeeded (14 audited, 52 exempted) CONTROL (proving the gate can still fail): restoring the previous Cargo.lock made `cargo update --locked` exit 101 again with "cannot update the lock file ... because --locked was passed"; re-applying the refreshed lock returned it to exit 0, and the restored file is byte-identical to the committed one. The gate is doing real work, not passing vacuously. Also commits supply-chain/imports.lock: refreshing the imported aggregate audit sets pulled in Google's indexmap audits, which is why indexmap could drop out of exemptions entirely -- a real human audit replacing a "nobody read this" placeholder. Verified this file is load-bearing rather than incidental: with the previous imports.lock, `cargo vet --locked` fails with "indexmap:2.14.0 missing [safe-to-deploy]"; with it, vetting succeeds. --- Cargo.lock | 12 ++++++------ supply-chain/config.toml | 10 +++------- supply-chain/imports.lock | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f6a6892..8130e0c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -95,9 +95,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "clap" -version = "4.6.4" +version = "4.6.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7" +checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca" dependencies = [ "clap_builder", "clap_derive", @@ -105,9 +105,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.2" +version = "4.6.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b" +checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889" dependencies = [ "anstream", "anstyle", @@ -454,9 +454,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.54" +version = "0.3.55" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244" +checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134" dependencies = [ "deranged", "num-conv", diff --git a/supply-chain/config.toml b/supply-chain/config.toml index bcbf937..a0238b0 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -44,11 +44,11 @@ version = "1.0.4" criteria = "safe-to-deploy" [[exemptions.clap]] -version = "4.6.4" +version = "4.6.6" criteria = "safe-to-deploy" [[exemptions.clap_builder]] -version = "4.6.2" +version = "4.6.6" criteria = "safe-to-deploy" [[exemptions.clap_derive]] @@ -87,10 +87,6 @@ criteria = "safe-to-deploy" version = "0.17.1" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.is_terminal_polyfill]] version = "1.70.2" criteria = "safe-to-deploy" @@ -184,7 +180,7 @@ version = "2.0.19" criteria = "safe-to-deploy" [[exemptions.time]] -version = "0.3.54" +version = "0.3.55" criteria = "safe-to-deploy" [[exemptions.time-core]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index d2e93cb..13184a9 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -113,6 +113,31 @@ https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24 """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.quote]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -217,6 +242,19 @@ criteria = "safe-to-deploy" version = "0.4.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.indexmap]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "2.8.0 -> 2.11.4" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.indexmap]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "2.11.4 -> 2.14.0" +notes = "Mostly internal refactorings. No new unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.powerfmt]] who = "Alex Franchuk " criteria = "safe-to-deploy"