diff --git a/Cargo.lock b/Cargo.lock index 9eba464..430d84f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -85,9 +85,9 @@ dependencies = [ [[package]] name = "forensic-vfs" -version = "0.7.0" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "285cbb38f775a1c3c476e7e20bffea29eea6a62f73e0721957c04cb3867d1fa6" +checksum = "f5c699c86fda2220f4e4bf00a6948eb4fe58b50343dbfadedba14dd417f22dfd" dependencies = [ "forensicnomicon-core", "state-history-forensic", diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 962f585..12d5867 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -3,32 +3,50 @@ [audits] +[[trusted.ewf]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-03-05" +end = "2027-08-07" + [[trusted.forensic-vfs]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-07" -end = "2027-08-05" +end = "2027-08-07" + +[[trusted.forensic-vfs-engine]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-17" +end = "2027-08-07" [[trusted.forensicnomicon]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-05" -end = "2027-08-05" +end = "2027-08-07" [[trusted.forensicnomicon-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-05" +end = "2027-08-07" [[trusted.forensicnomicon-data]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-05" +end = "2027-08-07" + +[[trusted.safe-read]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-15" +end = "2027-08-07" [[trusted.state-history-forensic]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-16" -end = "2027-08-05" +end = "2027-08-07" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 0330bb1..bc542ee 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -74,10 +74,6 @@ criteria = "safe-to-deploy" version = "1.0.107" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.47" -criteria = "safe-to-deploy" - [[exemptions.ripemd]] version = "0.1.3" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index d8ba1ad..f6f7e44 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -2,8 +2,8 @@ # cargo-vet imports lock [[publisher.forensic-vfs]] -version = "0.7.0" -when = "2026-07-20" +version = "0.7.1" +when = "2026-08-07" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" @@ -51,4 +51,64 @@ version = "1.5.0" notes = "Unsafe review in https://crrev.com/c/5838022" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[audits.mozilla.audits] +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.0.35" +notes = """ +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits +(except for benign "net" hit in tests and "fs" hit in README.md) +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.35 -> 1.0.36" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.36 -> 1.0.37" +notes = """ +The delta just 1) inlines/expands `impl ToTokens` that used to be handled via +`primitive!` macro and 2) adds `impl ToTokens` for `CStr` and `CString`. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.37 -> 1.0.38" +notes = "Still no unsafe" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Daniel Cheng " +criteria = "safe-to-deploy" +delta = "1.0.38 -> 1.0.39" +notes = "Only minor changes for clippy lints and documentation." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.39 -> 1.0.40" +notes = """ +The delta is just a simplification of how `tokens.extend(...)` call is made. +Still no `unsafe` anywhere. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.mozilla.audits.quote]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.40 -> 1.0.45" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.quote]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.45 -> 1.0.47" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"