From 09979cd59221952b49e82271983f73b8ca1650c0 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 2 Aug 2026 03:13:45 +0800 Subject: [PATCH] fix(supply-chain): trust our own crates instead of exempting them ADR-0018 ranks the four cargo-vet mechanisms and states that reaching for a weaker one is a defect. These crates are ours, consumed from crates.io, so case 2 applies: a publisher-trust entry under h4x0r (user-id 347968), not an exemption. The distinction is semantic, not cosmetic. An exemption asserts "unreviewed, accepted anyway"; a trust entry asserts "the publisher is ours". Recording our own crates as unreviewed-but-tolerated misstated the supply-chain posture in the direction of false comfort. A trust entry is also version-agnostic, so it does not go stale on the next bump the way a pinned exemption does. Exemption -> trust: - forensic-vfs - forensicnomicon - forensicnomicon-core - forensicnomicon-data - lzvn-core - state-history-forensic Verified (config change, so the vet run is the test): Vetting Succeeded (8 fully audited, 11 exempted) WARN Your supply-chain has unnecessary exemptions which could be relaxed or pruned. WARN Consider running `cargo vet prune` to prune unnecessary exemptions and imports. Co-Authored-By: Claude Opus 5 (1M context) --- supply-chain/audits.toml | 36 +++++++++++++++++++++++++++++++++ supply-chain/config.toml | 24 ---------------------- supply-chain/imports.lock | 42 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 78 insertions(+), 24 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2772ccb..3f6571c 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2,3 +2,39 @@ # cargo-vet audits file [audits] + +[[trusted.forensic-vfs]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-07" +end = "2027-08-01" + +[[trusted.forensicnomicon]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-05" +end = "2027-08-01" + +[[trusted.forensicnomicon-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-01" + +[[trusted.forensicnomicon-data]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-01" + +[[trusted.lzvn-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-17" +end = "2027-08-01" + +[[trusted.state-history-forensic]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-16" +end = "2027-08-01" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 98090c0..56515bb 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -31,30 +31,10 @@ criteria = "safe-to-deploy" version = "1.1.9" criteria = "safe-to-deploy" -[[exemptions.forensic-vfs]] -version = "0.7.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon]] -version = "1.8.1" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-core]] -version = "1.4.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-data]] -version = "1.3.2" -criteria = "safe-to-deploy" - [[exemptions.lzfse_rust]] version = "0.2.1" criteria = "safe-to-deploy" -[[exemptions.lzvn-core]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.proc-macro2]] version = "1.0.107" criteria = "safe-to-deploy" @@ -67,10 +47,6 @@ criteria = "safe-to-deploy" version = "0.3.10" criteria = "safe-to-deploy" -[[exemptions.state-history-forensic]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.syn]] version = "3.0.2" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index ccd7c76..3f873fe 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,48 @@ # cargo-vet imports lock +[[publisher.forensic-vfs]] +version = "0.7.0" +when = "2026-07-20" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon]] +version = "1.8.1" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-core]] +version = "1.4.0" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-data]] +version = "1.3.2" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.lzvn-core]] +version = "0.1.0" +when = "2026-06-17" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.state-history-forensic]] +version = "0.1.0" +when = "2026-06-16" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[audits.bytecode-alliance.audits.adler2]] who = "Alex Crichton " criteria = "safe-to-deploy"