From 1947c1d8bbae362fecf6ad10ac283edde3603a12 Mon Sep 17 00:00:00 2001 From: Jerry Xie Date: Tue, 12 May 2026 15:21:20 -0500 Subject: [PATCH 1/9] Add cargo-vet and cargo-deny supply-chain security --- .github/workflows/cargo-vet-pr-comment.yml | 137 +++++++++++++++++++++ .github/workflows/cargo-vet.yml | 53 ++++++++ supply-chain/audits.toml | 3 + supply-chain/config.toml | 13 ++ supply-chain/imports.lock | 7 ++ 5 files changed, 213 insertions(+) create mode 100644 .github/workflows/cargo-vet-pr-comment.yml create mode 100644 .github/workflows/cargo-vet.yml create mode 100644 supply-chain/audits.toml create mode 100644 supply-chain/config.toml create mode 100644 supply-chain/imports.lock diff --git a/.github/workflows/cargo-vet-pr-comment.yml b/.github/workflows/cargo-vet-pr-comment.yml new file mode 100644 index 0000000..ba9caa4 --- /dev/null +++ b/.github/workflows/cargo-vet-pr-comment.yml @@ -0,0 +1,137 @@ +# This workflow triggers after cargo-vet workflow has run. +# It adds a comment to the PR with the results of the cargo vet run. +# It first adds a comment if the cargo vet run fails, +# and updates the comment if the cargo vet run succeeds after having failed at least once. + +name: Cargo vet PR comment + +on: + workflow_run: + workflows: [cargo-vet] + types: + - completed + +permissions: + contents: read + pull-requests: write + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + + find-pr-comment: + # This job runs when the cargo-vet job fails or succeeds + # It will download the artifact from the failed job and post a comment on the PR + runs-on: ubuntu-latest + outputs: + comment-id: ${{ steps.get-comment-id.outputs.comment-id }} + pr-number: ${{ steps.get-pr-number.outputs.pr_number }} + if: github.event.workflow_run.event == 'pull_request' + steps: + - name: 'Download artifact' + uses: actions/download-artifact@v4 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + name: pr + path: pr/ + run-id: ${{ github.event.workflow_run.id }} + + - name: 'Get PR number' + id: get-pr-number + run: echo "pr_number=$(cat ./pr/NR)" >> $GITHUB_OUTPUT + + - name: 'Find existing comment' + id: find-comment + uses: peter-evans/find-comment@v3 + with: + issue-number: ${{ steps.get-pr-number.outputs.pr_number }} + comment-author: 'github-actions[bot]' + body-includes: 'comment-tag: [cargo-vet]' + + - name: 'Get comment ID' + id: get-comment-id + if: ${{ steps.find-comment.outputs.comment-id != '' }} + run: echo "comment-id=${{ steps.find-comment.outputs.comment-id }}" >> $GITHUB_OUTPUT + + post-comment-failure: + # This job runs when the cargo-vet job fails + # It will download the artifact from the failed job and post a comment on the PR + runs-on: ubuntu-latest + needs: find-pr-comment + if: github.event.workflow_run.conclusion == 'failure' + steps: + - name: 'Comment on PR - Failure' + uses: peter-evans/create-or-update-comment@v4 + with: + comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} + issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} + body: | + # Cargo Vet Audit Failed + + `cargo vet` has failed in this PR. Please run `cargo vet --locked` locally to check for new or updated unvetted dependencies. + Details about the vetting process can be found in [supply-chain/README.md](../blob/main/supply-chain/README.md) + + ## If the unvetted dependencies are not needed + Please modify Cargo.toml file to avoid including the dependencies. + + ## If the unvetted dependencies are needed + Post a new comment with the questionnaire below to the PR to help the auditors vet the dependencies. + After the auditors have vetted the dependencies, the PR will need to be rebased to pick up the new audits and pass this check. + + ### Copy and paste the questionnaire as a new comment and provide your answers: + + **1. What crates (with version) need to be audited?** + + **2. How many of the crates are version updates vs new dependencies?** + + **3. To confirm none of the already included crates serve your needs, please provide a brief description of the purpose of the new crates.** + + **4. Any extra notes to the auditors to help with their audits.** + + + edit-mode: replace + + - name: 'Label PR' + uses: actions/github-script@v7 + with: + script: | + github.rest.issues.addLabels({ + issue_number: ${{ needs.find-pr-comment.outputs.pr-number }}, + owner: context.repo.owner, + repo: context.repo.repo, + labels: ['cargo vet'] + }) + + post-comment-success: + # This job runs when the cargo-vet job succeeds + # It will update the comment on the PR with a success message + runs-on: ubuntu-latest + needs: find-pr-comment + if: github.event.workflow_run.conclusion == 'success' + steps: + - name: 'Comment on PR - Success' + # Only update the comment if it exists + # This is to avoid creating a new comment if the cargo-vet job has never failed before + if: ${{ needs.find-pr-comment.outputs.comment-id }} + uses: peter-evans/create-or-update-comment@v4 + with: + comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} + issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} + body: | + # Cargo Vet Audit Passed + `cargo vet` has passed in this PR. No new unvetted dependencies were found. + + + edit-mode: replace diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml new file mode 100644 index 0000000..8d825aa --- /dev/null +++ b/.github/workflows/cargo-vet.yml @@ -0,0 +1,53 @@ +# This workflow runs whenever a PR is opened or updated. It runs cargo vet to check for unvetted dependencies in the Cargo.lock file. +permissions: + contents: read +on: + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +name: cargo-vet +jobs: + vet: + # cargo-vet checks for unvetted dependencies in the Cargo.lock file + # This is to ensure that new dependencies are vetted before they are added to the project + name: vet-dependencies + runs-on: ubuntu-latest + env: + CARGO_VET_VERSION: 0.10.1 + + steps: + - uses: actions/checkout@v4 + with: + submodules: true + + - uses: actions/cache@v4 + with: + path: ${{ runner.tool_cache }}/cargo-vet + key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }} + + - name: Add the tool cache directory to the search path + run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH + + - name: Ensure that the tool cache is populated with the cargo-vet binary + run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ env.CARGO_VET_VERSION }} cargo-vet + + - name: Invoke cargo-vet + run: cargo vet --locked + + - name: Save PR number + # PR number is saved as an artifact so it can be used to determine the PR to comment on by the vet-pr-comment workflow + # vet-pr-comment workflow is triggered by the workflow_run event so it runs in the context of the base branch and not the PR branch + if: ${{ failure() }} || ${{ success() }} + run: | + mkdir -p ./pr + echo ${{ github.event.number }} > ./pr/NR + - uses: actions/upload-artifact@v4 + # Need to upload the artifact in both success and failure cases so comment can be updated in either case + if: ${{ failure() }} || ${{ success() }} + with: + name: pr + path: pr/ + overwrite: true diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml new file mode 100644 index 0000000..bb0e94c --- /dev/null +++ b/supply-chain/audits.toml @@ -0,0 +1,3 @@ +# cargo-vet audits file + +[audits] diff --git a/supply-chain/config.toml b/supply-chain/config.toml new file mode 100644 index 0000000..f5150e2 --- /dev/null +++ b/supply-chain/config.toml @@ -0,0 +1,13 @@ +# cargo-vet config file + +[cargo-vet] +version = "0.10" + +[imports.OpenDevicePartnership] +url = "https://raw.githubusercontent.com/OpenDevicePartnership/rust-crate-audits/main/audits.toml" + +[imports.google] +url = "https://raw.githubusercontent.com/google/rust-crate-audits/main/audits.toml" + +[imports.mozilla] +url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock new file mode 100644 index 0000000..04903c1 --- /dev/null +++ b/supply-chain/imports.lock @@ -0,0 +1,7 @@ +# cargo-vet imports lock + +[audits.OpenDevicePartnership.audits] + +[audits.google.audits] + +[audits.mozilla.audits] From 63df27f4686732db1b7788359d901a05b848aadc Mon Sep 17 00:00:00 2001 From: Jerry Xie <139205137+jerrysxie@users.noreply.github.com> Date: Sun, 17 May 2026 17:53:44 -0500 Subject: [PATCH 2/9] Add supply-chain/README.md --- supply-chain/README.md | 83 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 supply-chain/README.md diff --git a/supply-chain/README.md b/supply-chain/README.md new file mode 100644 index 0000000..07d41ff --- /dev/null +++ b/supply-chain/README.md @@ -0,0 +1,83 @@ +# Working with cargo vet + +## Introduction + +`cargo vet` is a tool to help ensure that third-party Rust dependencies have been audited by a trusted entity. +It matches all dependencies against a set of audits conducted by the authors of the project or entities they trust. +To learn more, visit [mozilla/cargo-vet](https://github.com/mozilla/cargo-vet) + +--- + +## Adding a new dependency + +When updating or adding a new dependency, we need to ensure it's audited before being merged into main. +For our repositories, we have designated experts who are responsible for vetting any new dependencies being added to their repository. +_It is the shared responsibility of the developer creating the PR and the auditors to conduct a successful audit._ +Follow the process below to ensure compliance: + +### For Developers +1. **Respond to `cargo vet` failures**: + - If your PR fails the `cargo vet` step, the cargo-vet workflow will add a comment to the PR with a template questionnaire + - Copy the questionnaire, fill it out and paste it as a new comment on the PR. This greatly helps the auditors get some context of the changes requiring the new dependencies + +2. **Engage with auditors**: + - Respond to any questions that the auditors might have regarding the need of any new dependencies + +3. **Rebase and verify**: + - At their discretion, auditors will check in their audits into either [rust-crate-audits](https://github.com/OpenDevicePartnership/rust-crate-audits) or into the same repository + - Once the new audits have been merged, rebase your branch on main and verify it passes `cargo vet` + ```bash + git fetch upstream + git rebase upstream/main + cargo vet + ``` + +4. **Update PR**: + - If the audits were checked into rust-crate-audits, they will show up in _imports.lock_ on running `cargo vet`. In this case add the updated _imports.lock_ to your PR + - If the audits were checked into the same repository, they will be present in _audits.toml_ after rebase and you can simply force push to your PR after rebase + ```bash + git push -f + ``` + +5. **Check PR status**: + - The existing PR comment from the previous failure will be updated with a success message once the check passes + +### For Auditors + +1. **Review the questionnaire**: + - Check the filled questionnaire on the PR once the developer responds to the `cargo vet` failure + - Respond to the developer comment in case more information is needed + +2. **Audit new dependencies**: + - Inspect the `cargo vet` failures using your preferred method + - Use [gh pr checkout](https://cli.github.com/manual/gh_pr_checkout) to checkout the PR and run `cargo vet --locked` + - Use [Github Pull Requests for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-pull-request-github) to checkout the PR and run `cargo vet --locked` + - For more suggestions: [Checking out pull requests locally](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally) + +3. **Follow `cargo vet` recommendations**: + - Follow the recommendations of the `cargo vet` command output, either `cargo vet diff` for version update or `cargo vet inspect` for new dependencies + +4. **Record audits**: + - Use `cargo vet certify` to add new audits to _audits.toml_ + - Verify all dependencies pass using `cargo vet` + +5. **Decide audit location**: + - **Shared audits**: New audits should ideally be shared across ODP repositories to reduce the overhead of multiple audits for the same dependencies. To facilitate this, it's recommended to cut and paste the new audits and submit as a separate PR to the _audits.toml_ in [rust-crate-audits](https://github.com/OpenDevicePartnership/rust-crate-audits) + - If due to business reasons, the audits are not to be shared across repositories, copy the updated _audits.toml_ to a new branch off main in the same repository and submit the PR to update the audits + +6. **Communicate successful audit**: + - Communicate to the PR developer via a PR comment so they can update the PR and get `cargo vet` to pass + +--- + +## Tips for using `cargo vet`: + +- **Update _imports.lock_**: + - Import trusted third party audits to reduce the number of new audits to be performed. Running `cargo vet` without `--locked` fetches new imports and updates _imports.lock_ with any audits that are helpful for our project. + +- **Add exemptions**: + - If an audit cannot be performed for some dependency due to time sensitivity or business justified reasons, use `cargo vet add-exemption ` to add the dependency to exemptions in _config.toml_ + - To add all remaining audits to exemptions at once, use `cargo vet regenerate exemptions` + +- **Prune unnecessary entries**: + - Remove unnecessary exemptions and imports using `cargo vet prune` From 97dc8441d6bd009e63f480e34062b7318ee8fb29 Mon Sep 17 00:00:00 2001 From: Jerry Xie <139205137+jerrysxie@users.noreply.github.com> Date: Sun, 17 May 2026 18:46:18 -0500 Subject: [PATCH 3/9] Fix supply-chain file formatting for cargo vet --- supply-chain/config.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index f5150e2..55618c2 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -1,3 +1,4 @@ + # cargo-vet config file [cargo-vet] From dd231d65dde787ac87ff4d119e20e778438f0c33 Mon Sep 17 00:00:00 2001 From: Jerry Xie <139205137+jerrysxie@users.noreply.github.com> Date: Sun, 17 May 2026 18:46:19 -0500 Subject: [PATCH 4/9] Fix supply-chain file formatting for cargo vet --- supply-chain/audits.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index bb0e94c..2772ccb 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -1,3 +1,4 @@ + # cargo-vet audits file [audits] From c3ad2fbb107c8d51803d7f9b1a68791fd9e77501 Mon Sep 17 00:00:00 2001 From: Jerry Xie <139205137+jerrysxie@users.noreply.github.com> Date: Sun, 17 May 2026 18:46:20 -0500 Subject: [PATCH 5/9] Fix supply-chain file formatting for cargo vet --- supply-chain/imports.lock | 1 + 1 file changed, 1 insertion(+) diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 04903c1..219dba4 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,3 +1,4 @@ + # cargo-vet imports lock [audits.OpenDevicePartnership.audits] From ca63a858153dca8b980132736ee76428fe0176b7 Mon Sep 17 00:00:00 2001 From: Jerry Xie Date: Sun, 17 May 2026 18:57:49 -0500 Subject: [PATCH 6/9] Add Cargo.lock, update .gitignore, add --locked to CI --- .github/workflows/check.yml | 8 +- .gitignore | 1 - Cargo.lock | 204 ++++++++++++++++++++++++++++++++++++ 3 files changed, 208 insertions(+), 5 deletions(-) create mode 100644 Cargo.lock diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 350a797..9e18f38 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -141,7 +141,7 @@ jobs: - name: Install nightly uses: dtolnay/rust-toolchain@nightly - name: cargo doc - run: cargo doc --no-deps --all-features + run: cargo doc --locked --no-deps --all-features env: RUSTDOCFLAGS: --cfg docsrs @@ -167,7 +167,7 @@ jobs: # intentionally no target specifier; see https://github.com/jonhoo/rust-ci-conf/pull/4 # --feature-powerset runs for every combination of features - name: cargo hack - run: cargo hack --feature-powerset check + run: cargo hack --feature-powerset check --locked deny: # cargo-deny checks licenses, advisories, sources, and bans for @@ -192,7 +192,7 @@ jobs: log-level: warn manifest-path: ./Cargo.toml command: check - arguments: --all-features + arguments: --all-features --locked msrv: # check that we can build using the minimal rust version that is specified by this crate @@ -228,4 +228,4 @@ jobs: with: toolchain: ${{ matrix.msrv }} - name: cargo +${{ matrix.msrv }} check - run: cargo check + run: cargo check --locked diff --git a/.gitignore b/.gitignore index 6985cf1..c4379b8 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,6 @@ target/ # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html -Cargo.lock # These are backup files generated by rustfmt **/*.rs.bk diff --git a/Cargo.lock b/Cargo.lock new file mode 100644 index 0000000..1fb313e --- /dev/null +++ b/Cargo.lock @@ -0,0 +1,204 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "bitfield-struct" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8769c4854c5ada2852ddf6fd09d15cf43d4c2aaeccb4de6432f5402f08a6003b" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + +[[package]] +name = "bitflags" +version = "2.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" + +[[package]] +name = "defmt" +version = "0.3.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad" +dependencies = [ + "defmt 1.1.0", +] + +[[package]] +name = "defmt" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6e524506490a1953d237cb87b1cfc1e46f88c18f10a22dfe0f507dc6bfc7f7f" +dependencies = [ + "bitflags 1.3.2", + "defmt-macros", +] + +[[package]] +name = "defmt-macros" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0a27770e9c8f719a79d8b638281f4d828f77d8fd61e0bd94451b9b85e576a0b" +dependencies = [ + "defmt-parser", + "proc-macro-error2", + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "defmt-parser" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e" +dependencies = [ + "thiserror", +] + +[[package]] +name = "embedded-batteries" +version = "0.3.4" +dependencies = [ + "bitfield-struct", + "bitflags 2.11.1", + "defmt 0.3.100", + "embedded-hal", + "zerocopy", +] + +[[package]] +name = "embedded-batteries" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "40f975432b4e146342a1589c563cffab6b7a692024cb511bf87b6bfe78c84125" +dependencies = [ + "bitfield-struct", + "bitflags 2.11.1", + "defmt 0.3.100", + "embedded-hal", + "zerocopy", +] + +[[package]] +name = "embedded-batteries-async" +version = "0.3.4" +dependencies = [ + "bitfield-struct", + "defmt 0.3.100", + "embedded-batteries 0.3.4 (registry+https://github.com/rust-lang/crates.io-index)", + "embedded-hal", +] + +[[package]] +name = "embedded-hal" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "361a90feb7004eca4019fb28352a9465666b24f840f5c3cddf0ff13920590b89" + +[[package]] +name = "proc-macro-error-attr2" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5" +dependencies = [ + "proc-macro2", + "quote", +] + +[[package]] +name = "proc-macro-error2" +version = "2.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802" +dependencies = [ + "proc-macro-error-attr2", + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "proc-macro2" +version = "1.0.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.45" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "syn" +version = "2.0.117" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "thiserror" +version = "2.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "unicode-ident" +version = "1.0.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" + +[[package]] +name = "zerocopy" +version = "0.8.48" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9" +dependencies = [ + "zerocopy-derive", +] + +[[package]] +name = "zerocopy-derive" +version = "0.8.48" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] From fb010decb3c90430e1e7ca9250cc9d483607b8a2 Mon Sep 17 00:00:00 2001 From: Jerry Xie Date: Tue, 9 Jun 2026 15:27:50 -0500 Subject: [PATCH 7/9] Fix cargo-vet policy and imports Add explicit audit-as-crates-io policy entries for workspace crates that share published versions on crates.io. Import bytecode-alliance audits and refresh imports.lock so cargo-vet can resolve bitflags coverage and pass in CI. Assisted-by: GitHub Copilot:GPT-5.3-Codex --- supply-chain/config.toml | 9 + supply-chain/imports.lock | 522 +++++++++++++++++++++++++++++++++++++- 2 files changed, 528 insertions(+), 3 deletions(-) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 55618c2..9b3506a 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -7,8 +7,17 @@ version = "0.10" [imports.OpenDevicePartnership] url = "https://raw.githubusercontent.com/OpenDevicePartnership/rust-crate-audits/main/audits.toml" +[imports.bytecode-alliance] +url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml" + [imports.google] url = "https://raw.githubusercontent.com/google/rust-crate-audits/main/audits.toml" [imports.mozilla] url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml" + +[policy.embedded-batteries] +audit-as-crates-io = true + +[policy.embedded-batteries-async] +audit-as-crates-io = true diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 219dba4..28c10a1 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -1,8 +1,524 @@ # cargo-vet imports lock -[audits.OpenDevicePartnership.audits] +[[audits.OpenDevicePartnership.audits.bitfield-struct]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +version = "0.10.1" +notes = "Proc-macro crate generating safe bitfield structs. No unsafe, no build script. Standard proc-macro deps only. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" -[audits.google.audits] +[[audits.OpenDevicePartnership.audits.bitfield-struct]] +who = "matteotullo " +criteria = "safe-to-deploy" +delta = "0.10.1 -> 0.12.1" +notes = "Adds hash and bitenum derives, mostly parsing and refactoring changes. No code execution nor writing to the filesystem." +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" -[audits.mozilla.audits] +[[audits.OpenDevicePartnership.audits.defmt]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +version = "0.3.100" +notes = "Compatibility shim: no_std crate that re-exports defmt 1.x items for 0.3 API compatibility. No unsafe code, no build script, no powerful imports, no logic - pure pub-use re-exports. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.defmt]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "1.0.1" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.defmt]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "1.0.1 -> 1.1.0" +notes = "Delta audit: No new unsafe code. build.rs adds xtensa-esp32s2-none-elf to no_cas list. New Format impls for core::fmt::Error and Wrapping are safe. Assisted-by: GitHub Copilot:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.defmt-macros]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "1.0.1" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.defmt-macros]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "1.0.1 -> 1.1.0" +notes = "Delta: adds transparent/bound derive attrs. No unsafe. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/bq40z50/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.defmt-parser]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "1.0.0" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.embedded-batteries]] +who = "matteotullo " +criteria = "safe-to-deploy" +version = "0.3.4" +notes = "ODP crates are always trusted." +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.embedded-batteries-async]] +who = "matteotullo " +criteria = "safe-to-deploy" +version = "0.3.4" +notes = "ODP crates are always trusted." +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.embedded-hal]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "0.2.7" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.embedded-hal]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "0.2.7 -> 1.0.0" +notes = "Pure no_std trait crate. Complete API redesign for 1.0: removed nb-based traits, CAN module, all unsafe code. Only defines traits/enums/types for digital, I2C, SPI, PWM, delay. No build script, no proc macros, no powerful imports. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.proc-macro-error-attr2]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "2.0.0" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.proc-macro-error2]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "2.0.1" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.syn]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "2.0.110" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.syn]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "2.0.110 -> 2.0.117" +notes = "Delta: no_std migration, receiver parsing fix. No new unsafe. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/bq40z50/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.thiserror]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "2.0.17" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.thiserror]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "2.0.17 -> 2.0.18" +notes = "Delta: build.rs match-to-let-else refactor. No new unsafe. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/bq40z50/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.thiserror-impl]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +version = "2.0.17" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/mcxa-pac/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.thiserror-impl]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "2.0.17 -> 2.0.18" +notes = "Delta: conditional clippy lint allows. No unsafe. Assisted-by: copilot-cli:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/bq40z50/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.unicode-ident]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "1.0.18 -> 1.0.24" +notes = "Delta: Unicode 16->17 table data update only. No unsafe, no build.rs, no new deps. Assisted-by: GitHub Copilot:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.zerocopy]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "0.8.27 -> 0.8.48" +notes = "Delta audit 0.8.27->0.8.48. Large refactor (34K lines, 648 files) but bulk is benchmarks, agent docs, UI test stderr, and CI scripts. Core changes: (1) build.rs inverted cfg logic (emit cfg if version < threshold) with new cfgs for x86 AVX-512 and aarch64 big-endian SIMD - still only reads env vars and emits cargo:rustc-cfg, no I/O. (2) Pointer module refactored cast system from ad-hoc PtrInner::cast into trait-based Project/Cast/CastExact with thorough SAFETY comments. (3) impls.rs simplified atomic/Cell/UnsafeCell transmute patterns, added tuple trait impls up to 26 elements with HasField/ProjectField. (4) Error types gained Clone/PartialEq/Eq impls, field renames. (5) Macros updated for Sized->unsized transmute_ref!/transmute_mut! support. (6) New ReadOnly wrapper type. No new ambient capabilities, no proc macros in this crate. All unsafe code has SAFETY comments citing specific Rust documentation versions. No build script I/O beyond cargo:rustc-cfg. Assisted-by: GitHub Copilot:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.OpenDevicePartnership.audits.zerocopy-derive]] +who = "Jerry Xie " +criteria = "safe-to-deploy" +delta = "0.8.27 -> 0.8.48" +notes = "Delta audit. Major refactor into derive/ modules and util.rs. No build.rs. No fs/net in proc-macro. All unsafe in generated code with SAFETY docs. Assisted-by: GitHub Copilot:claude-opus-4.6" +aggregated-from = "https://raw.githubusercontent.com/OpenDevicePartnership/embedded-services/refs/heads/main/supply-chain/audits.toml" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Jamey Sharp " +criteria = "safe-to-deploy" +delta = "2.1.0 -> 2.2.1" +notes = """ +This version adds unsafe impls of traits from the bytemuck crate when built +with that library enabled, but I believe the impls satisfy the documented +safety requirements for bytemuck. The other changes are minor. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.3.2 -> 2.3.3" +notes = """ +Nothing outside the realm of what one would expect from a bitflags generator, +all as expected. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.4.1 -> 2.6.0" +notes = """ +Changes in how macros are invoked and various bits and pieces of macro-fu. +Otherwise no major changes and nothing dealing with `unsafe`. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.7.0 -> 2.9.4" +notes = "Tweaks to the macro, nothing out of order." + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.10.0 -> 2.11.1" +notes = "Minor updates, nothing awry here." + +[[audits.google.audits.bitflags]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.3.2" +notes = """ +Security review of earlier versions of the crate can be found at +(Google-internal, sorry): go/image-crate-chromium-security-review + +The crate exposes a function marked as `unsafe`, but doesn't use any +`unsafe` blocks (except for tests of the single `unsafe` function). I +think this justifies marking this crate as `ub-risk-1`. + +Additional review comments can be found at https://crrev.com/c/4723145/31 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.0.78" +notes = """ +Grepped for "crypt", "cipher", "fs", "net" - there were no hits +(except for a benign "fs" hit in a doc comment) + +Notes from the `unsafe` review can be found in https://crrev.com/c/5385745. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.78 -> 1.0.79" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.79 -> 1.0.80" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.80 -> 1.0.81" +notes = "Comment changes only" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.81 -> 1.0.82" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.82 -> 1.0.83" +notes = "Substantive change is replacing String with Box, saving memory." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.83 -> 1.0.84" +notes = "Only doc comment changes in `src/lib.rs`." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj@chromium.org" +criteria = "safe-to-deploy" +delta = "1.0.84 -> 1.0.85" +notes = "Test-only changes." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.85 -> 1.0.86" +notes = """ +Comment-only changes in `build.rs`. +Reordering of `Cargo.toml` entries. +Just bumping up the version number in `lib.rs`. +Config-related changes in `test_size.rs`. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "danakj " +criteria = "safe-to-deploy" +delta = "1.0.86 -> 1.0.87" +notes = "No new unsafe interactions." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.proc-macro2]] +who = "Liza Burakova ", + "Erich Gubler ", +] +criteria = "safe-to-deploy" +delta = "2.6.0 -> 2.7.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Benjamin VanderSloot " +criteria = "safe-to-deploy" +delta = "2.9.4 -> 2.10.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.proc-macro2]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.94 -> 1.0.106" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.quote]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.40 -> 1.0.45" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.zerocopy]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.7.32" +notes = """ +This crate is `no_std` so doesn't use any side-effectful std functions. It +contains quite a lot of `unsafe` code, however. I verified portions of this. It +also has a large, thorough test suite. The project claims to run tests with +Miri to have stronger soundness checks, and also claims to use formal +verification tools to prove correctness. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.zerocopy]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.7.32 -> 0.8.27" +notes = """ +These changes are enormous, however unsafe code is kept somewhat minimal in +comparison. The safety properties of unsafe code blocks, traits, and other +types are thoroughly documented. The new build script is safe. All code is very +thoroughly tested. I expect their test coverage is quite high. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.zerocopy-derive]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.7.32" +notes = "Clean, safe macros for zerocopy." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.zerocopy-derive]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.7.32 -> 0.8.27" +notes = """ +There are a lot of changes here, however they look reasonable. Unsafe code is +heavily documented, and there are extensive tests for the changes. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" From 823cdedd7e99be0c5df9e3cea4799aeb777aefc6 Mon Sep 17 00:00:00 2001 From: Jerry Xie Date: Tue, 9 Jun 2026 15:34:53 -0500 Subject: [PATCH 8/9] Upgrade cargo-vet to 0.10.2 in workflow --- .github/workflows/cargo-vet.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml index 8d825aa..5e797a7 100644 --- a/.github/workflows/cargo-vet.yml +++ b/.github/workflows/cargo-vet.yml @@ -16,7 +16,7 @@ jobs: name: vet-dependencies runs-on: ubuntu-latest env: - CARGO_VET_VERSION: 0.10.1 + CARGO_VET_VERSION: 0.10.2 steps: - uses: actions/checkout@v4 From 0c0edcd2ee9547e064058dc5cf7057303ca89f80 Mon Sep 17 00:00:00 2001 From: Jerry Xie Date: Tue, 9 Jun 2026 15:39:39 -0500 Subject: [PATCH 9/9] Ignore RUSTSEC-2026-0173 in cargo-deny config The all-features CI build pulls proc-macro-error2 via defmt-macros, which triggers RUSTSEC-2026-0173 (unmaintained). No safe upgrade is available and migration must happen upstream, so add it to the advisories ignore list alongside the existing RUSTSEC-2024-0370 entry. Assisted-by: GitHub Copilot:claude-opus-4.8 --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index 9afdc8c..9ae4953 100644 --- a/deny.toml +++ b/deny.toml @@ -75,6 +75,7 @@ ignore = [ #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" }, { id = "RUSTSEC-2024-0370", reason = "proc-macro-error is unmaintained, no safe upgrade available, need upstream dependencies to migrate away from it." }, + { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is unmaintained, no safe upgrade available, need upstream dependencies to migrate away from it." }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library.