From ec7f6ddcd6ace4fe69232c288515fa6ff87e8bb7 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 06:48:47 -0700 Subject: [PATCH 1/3] ci: adopt the fleet reusable workflow Replace the hand-maintained ci.yml with a call to SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml, pinned to 619094ad54edc586f5c2733358e00326b30790bd, keeping the geiger job verbatim. msrv-check: test -- the old MSRV job ran `cargo test` at 1.75, not a bare build. coverage-ignore-regex: "/tests/|/fuzz/" -- the old coverage job already ran the fleet per-line gate, but its test/fuzz exclusion was written inside the inline Python (`if "/tests/" in cur or "/fuzz/" in cur: continue`) rather than as an --ignore-filename-regex flag. Same exclusion, expressed the way this workflow takes it. Verified load-bearing on origin/main (tests/coverage.rs, fuzz/fuzz_targets/*.rs all match) and re-running the shared gate's rules over `cargo llvm-cov --workspace --all-features` with this regex gives 0 uncovered / 2 annotated exemptions -- green, unchanged. The crate declares no cargo features, so the --all-features default changes nothing relative to the old `cargo test --workspace`. One gate the shared workflow adds that this repo did not have: rustdoc with -D warnings (plus the single-checkout path-dependency check). --- .github/workflows/ci.yml | 157 +++++---------------------------------- 1 file changed, 20 insertions(+), 137 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bcaa06b..905d36a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,126 +6,28 @@ on: pull_request: branches: [main] -env: - CARGO_TERM_COLOR: always - CARGO_INCREMENTAL: "0" - RUSTFLAGS: -Dwarnings +permissions: + contents: read jobs: - fmt: - name: Format - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - with: - components: rustfmt - - run: cargo fmt --all --check - - clippy: - name: Clippy - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - with: - components: clippy - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo clippy --all-targets -- -D warnings - - test: - name: Test (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo test --workspace - - coverage: - name: Coverage (100% production lines) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - with: - components: llvm-tools-preview - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo install cargo-llvm-cov --locked - - name: Fail on any uncovered production line (DA:n,0), honoring cov:unreachable - run: | - cargo llvm-cov --workspace --lcov --output-path cov.lcov - python3 - <<'PY' - import sys - def marked(path, n): - try: - return "cov:unreachable" in open(path).read().splitlines()[n - 1] - except Exception: - return False - cur, bad = None, [] - for line in open("cov.lcov").read().splitlines(): - if line.startswith("SF:"): - cur = line[3:] - elif line.startswith("DA:") and cur: - if "/tests/" in cur or "/fuzz/" in cur: - continue - n, hits = line[3:].split(",") - if hits == "0" and not marked(cur, int(n)): - bad.append(f"{cur}:{n}") - if bad: - print("Uncovered production lines — add a test or // cov:unreachable:") - print("\n".join(f" {b}" for b in bad)) - sys.exit(1) - print("100% production line coverage — no uncovered DA:n,0") - PY - - deny: - name: Cargo Deny - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 - - msrv: - name: MSRV (1.75) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@1.75 - - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - - run: cargo test - - fuzz-check: - name: Fuzz (build check) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # nightly - with: - toolchain: nightly - components: rust-src - - run: cargo install cargo-fuzz --locked - - run: cargo +nightly fuzz build - - secrets: - name: Secret Scan (gitleaks) - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - - name: Install gitleaks - run: | - VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name[1:]') - curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar xz -C /tmp gitleaks - - name: Run gitleaks - run: /tmp/gitleaks detect --source . - + ci: + uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd + with: + # The old MSRV job ran `cargo test` at 1.75, not a bare build. The + # default (`build`) would verify less than CI already did. + msrv-check: test + # The old coverage gate is the fleet per-line gate (strict, which is the + # default here) but it skipped test and fuzz scaffolding — written inside + # the inline Python as `if "/tests/" in cur or "/fuzz/" in cur: continue`, + # not as an --ignore-filename-regex flag. Same exclusion, expressed the + # way this workflow takes it. Verified load-bearing on origin/main: + # tests/coverage.rs, fuzz/fuzz_targets/{fuzz_feed,fuzz_known_good}.rs + # all match, and re-running the shared gate's own rules over + # `cargo llvm-cov --workspace --all-features` with this regex gives + # 0 uncovered / 2 annotated exemptions — i.e. green, unchanged. + coverage-ignore-regex: "/tests/|/fuzz/" + + # -- carried across verbatim from the previous ci.yml --------------------- geiger: name: Unsafe Audit (cargo-geiger) runs-on: ubuntu-latest @@ -136,22 +38,3 @@ jobs: - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 - run: cargo install cargo-geiger --locked - run: cargo geiger 2>&1 || true - - vet: - name: Cargo Vet (supply-chain) - runs-on: ubuntu-latest - # Complements `deny` (known-bad advisories/licenses) with the supply-chain- - # injection layer: every dependency version must be human-source-reviewed or - # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/ - # Embark). Config in supply-chain/{config,audits,imports}.toml. - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: dtolnay/rust-toolchain@stable - - name: Install cargo-vet - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6 - with: - tool: cargo-vet - - name: Fetch dependencies - run: cargo fetch - - name: Check supply chain - run: cargo vet --locked From 4fd3baab051c3eedcd86717dcb27bef02593c3f7 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 16:21:53 -0700 Subject: [PATCH 2/3] fix(msrv): pin getrandom down to 0.3.4 so `cargo test` runs at the declared 1.75 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The new per-member MSRV matrix runs this repo's configured check (`msrv-check: test`) at the floor forensic-hashdb declares, and it refused: error: failed to parse manifest at .../getrandom-0.4.3/Cargo.toml feature `edition2024` is required ... not stabilized in this version of Cargo (1.75.0) Diagnosis — the declared floor is TRUE and was not the problem: * `cargo +1.75 build -p forensic-hashdb --all-features` PASSES. The library's own source and its normal dependency graph are fine at 1.75. * The refusal is confined to the TEST target's dev-dependency graph: getrandom 0.4.3 <- tempfile 3.27.0 <- [dev-dependencies] forensic-hashdb. getrandom 0.4.x is `edition = "2024"`, which fails at MANIFEST PARSE below cargo 1.85 regardless of what the code uses. * Dev-dependencies do not propagate to consumers, so this never reached anyone depending on forensic-hashdb. `rust-version = "1.75"` remains a truthful promise and raising it would have been a false raise that breaks downstreams for no reason. Fix: pin getrandom to 0.3.4 (declares 1.63, edition 2021), which also brings r-efi 6.0.0 -> 5.3.0. tempfile stays at 3.27.0 — its requirement accepts getrandom 0.3, so no dev-dependency was downgraded. Controls (cargo test -p forensic-hashdb --all-features, the exact check the MSRV job runs): before pin, 1.75 -> FAIL (`edition2024` required, getrandom 0.4.3) after pin, 1.75 -> PASS (26 + 5 + 0 tests, 0 failed) after pin, 1.96 -> PASS (workspace, all features, same counts) Note for whoever tunes Renovate here: `lockFileMaintenance` will walk getrandom back to 0.4.x and re-red this job. A durable alternative is a capped dev-dependency requirement on tempfile/getrandom, which costs consumers nothing because dev-deps do not propagate. Co-Authored-By: Claude Opus 5 --- Cargo.lock | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2cfb9bf..aea54c1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -40,13 +40,14 @@ dependencies = [ [[package]] name = "getrandom" -version = "0.4.3" +version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", "libc", "r-efi", + "wasip2", ] [[package]] @@ -78,9 +79,9 @@ checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" [[package]] name = "r-efi" -version = "6.0.0" +version = "5.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" [[package]] name = "rustix" @@ -108,6 +109,15 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "wasip2" +version = "1.0.4+wasi-0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487" +dependencies = [ + "wit-bindgen", +] + [[package]] name = "windows-link" version = "0.2.1" @@ -122,3 +132,9 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" dependencies = [ "windows-link", ] + +[[package]] +name = "wit-bindgen" +version = "0.57.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" From ecb1293078cb488a1945a37343d41274d5d8c9aa Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Fri, 7 Aug 2026 17:01:26 -0700 Subject: [PATCH 3/3] fix(supply-chain): vet records for the versions the MSRV pin resolves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pinning a dependency down to keep this repo's declared MSRV achievable moved the resolved set, and the vet store had no record for the versions that came out. Each takes the strongest mechanism that applies per ADR-0018: publisher trust for crates we publish or whose publisher an imported aggregate auditor already vouches for, and honest [[exemptions]] only for the remainder. An exemption asserts that nobody audited the crate — equally true before and after a version change — so refreshing one claims nothing new. No `cargo vet certify --accept-all`: a certify record asserts a human read the source, so bulk-certifying fabricates the condition being claimed. audits.toml carries zero self-certified entries after this change. `cargo vet --locked` passes. --- supply-chain/audits.toml | 54 +++++++++++++++++++++++++++++++++++++++ supply-chain/config.toml | 4 +-- supply-chain/imports.lock | 30 ++++++++++++++++++++++ 3 files changed, 86 insertions(+), 2 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2772ccb..cafe18e 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2,3 +2,57 @@ # cargo-vet audits file [audits] + +[[trusted.ewf]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-03-05" +end = "2027-08-08" + +[[trusted.forensic-vfs]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-07-07" +end = "2027-08-08" + +[[trusted.forensicnomicon]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-06-05" +end = "2027-08-08" + +[[trusted.forensicnomicon-core]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-06-28" +end = "2027-08-08" + +[[trusted.forensicnomicon-data]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-06-28" +end = "2027-08-08" + +[[trusted.jsonguard]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-05-21" +end = "2027-08-08" + +[[trusted.safe-decode]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-08-02" +end = "2027-08-08" + +[[trusted.safe-read]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-07-15" +end = "2027-08-08" + +[[trusted.state-history-forensic]] +criteria = "safe-to-deploy" +user-id = 347968 +start = "2026-06-16" +end = "2027-08-08" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 7c6fe2c..f40f147 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -36,7 +36,7 @@ version = "2.4.1" criteria = "safe-to-run" [[exemptions.getrandom]] -version = "0.4.3" +version = "0.3.4" criteria = "safe-to-run" [[exemptions.libc]] @@ -56,7 +56,7 @@ version = "1.21.4" criteria = "safe-to-run" [[exemptions.r-efi]] -version = "6.0.0" +version = "5.3.0" criteria = "safe-to-run" [[exemptions.rustix]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 20fa710..7ddfd8e 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,36 @@ # cargo-vet imports lock +[[publisher.wasip2]] +version = "1.0.4+wasi-0.2.12" +when = "2026-06-12" +user-id = 1 +user-login = "alexcrichton" +user-name = "Alex Crichton" + +[[publisher.wit-bindgen]] +version = "0.57.1" +when = "2026-04-17" +trusted-publisher = "github:bytecodealliance/wit-bindgen" + +[[audits.bytecode-alliance.wildcard-audits.wasip2]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +user-id = 1 # Alex Crichton (alexcrichton) +start = "2025-08-10" +end = "2026-08-21" +notes = """ +This is a Bytecode Alliance authored crate. +""" + +[[audits.bytecode-alliance.wildcard-audits.wit-bindgen]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +trusted-publisher = "github:bytecodealliance/wit-bindgen" +start = "2025-08-13" +end = "2027-01-08" +notes = "The Bytecode Alliance is the author of this crate" + [audits.bytecode-alliance.audits] [audits.embark.audits]