From 048d38457db9eeb0e9250d8a40590c10bd43924e Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Wed, 5 Aug 2026 15:25:31 -0700 Subject: [PATCH] fix(supply-chain): trust our own crates instead of exempting them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These crates are ours, published to crates.io by h4x0r, so ADR-0018 mechanism (2) — a trust entry — applies. They were carried as version-pinned [[exemptions]], which is mechanism (4), the last resort. Taking the weaker mechanism where a stronger one applies is the defect, and it guarantees the recurrence: an exemption names a single version, so every release we cut reddens this repo again. A trust entry records the publisher instead and survives bumps. Rebuilt on current main rather than rebased. The original branch conflicted because main had moved the same supply-chain files underneath it, and re-deriving the change is more trustworthy than hand-resolving a conflict in files that encode security assertions. The crate list is taken from the original PR, so the intent is unchanged. Verified by making it fail on purpose: with the trust entries removed `cargo vet --locked` fails naming exactly these crates, and with them restored it succeeds. That control is required here because each repo still carries unrelated exemptions, and a green run over those alone would prove nothing. --- supply-chain/audits.toml | 24 ++++++++++++++++++++++++ supply-chain/config.toml | 16 ---------------- supply-chain/imports.lock | 28 ++++++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 16 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 749165e..962f585 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -3,6 +3,30 @@ [audits] +[[trusted.forensic-vfs]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-07" +end = "2027-08-05" + +[[trusted.forensicnomicon]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-05" +end = "2027-08-05" + +[[trusted.forensicnomicon-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-05" + +[[trusted.forensicnomicon-data]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-05" + [[trusted.state-history-forensic]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 115c9ea..0330bb1 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -50,22 +50,6 @@ criteria = "safe-to-deploy" version = "0.10.7" criteria = "safe-to-deploy" -[[exemptions.forensic-vfs]] -version = "0.7.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon]] -version = "1.8.1" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-core]] -version = "1.4.0" -criteria = "safe-to-deploy" - -[[exemptions.forensicnomicon-data]] -version = "1.3.2" -criteria = "safe-to-deploy" - [[exemptions.generic-array]] version = "0.14.7" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 14fd3bb..d8ba1ad 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,6 +1,34 @@ # cargo-vet imports lock +[[publisher.forensic-vfs]] +version = "0.7.0" +when = "2026-07-20" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon]] +version = "1.8.1" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-core]] +version = "1.4.0" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + +[[publisher.forensicnomicon-data]] +version = "1.3.2" +when = "2026-07-19" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[publisher.state-history-forensic]] version = "0.1.1" when = "2026-08-05"