Skip to content

Commit 1605a87

Browse files
sbernauersbernauer
authored
chore: Use upstream deny.toml (#1529)
Pull in the upstream version in https://github.com/stackabletech/operator-templating/blob/main/template/deny.toml
1 parent 86c72b0 commit 1605a87

1 file changed

Lines changed: 74 additions & 68 deletions

File tree

‎deny.toml‎

Lines changed: 74 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -5,65 +5,65 @@
55

66
[graph]
77
targets = [
8-
{ triple = "x86_64-unknown-linux-gnu" },
9-
{ triple = "aarch64-unknown-linux-gnu" },
10-
{ triple = "x86_64-unknown-linux-musl" },
11-
{ triple = "aarch64-apple-darwin" },
12-
{ triple = "x86_64-apple-darwin" },
8+
{ triple = "x86_64-unknown-linux-gnu" },
9+
{ triple = "aarch64-unknown-linux-gnu" },
10+
{ triple = "x86_64-unknown-linux-musl" },
11+
{ triple = "aarch64-apple-darwin" },
12+
{ triple = "x86_64-apple-darwin" },
1313
]
1414

1515
[advisories]
1616
yanked = "deny"
1717
ignore = [
18-
# https://rustsec.org/advisories/RUSTSEC-2023-0071
19-
# "rsa" crate: Marvin Attack: potential key recovery through timing sidechannel
20-
#
21-
# No patch is yet available, however work is underway to migrate to a fully constant-time implementation.
22-
# So we need to accept this, as of SDP 26.3 we are "only" using the crate to create private +
23-
# public key pairs used by webhooks, such as conversion or mutating webhooks.
24-
#
25-
# https://github.com/RustCrypto/RSA/issues/19 is the tracking issue
26-
"RUSTSEC-2023-0071",
18+
# https://rustsec.org/advisories/RUSTSEC-2023-0071
19+
# "rsa" crate: Marvin Attack: potential key recovery through timing sidechannel
20+
#
21+
# No patch is yet available, however work is underway to migrate to a fully constant-time implementation.
22+
# So we need to accept this, as of SDP 26.3 we are "only" using the crate to create private +
23+
# public key pairs used by webhooks, such as conversion or mutating webhooks.
24+
#
25+
# https://github.com/RustCrypto/RSA/issues/19 is the tracking issue
26+
"RUSTSEC-2023-0071",
2727

28-
# https://rustsec.org/advisories/RUSTSEC-2024-0436
29-
# The "paste" crate is no longer maintained because the owner states that the implementation is
30-
# finished. There are at least two (forked) alternatives which state to be maintained. They'd
31-
# need to be vetted before a potential switch. Additionally, they'd need to be in a maintained
32-
# state for a couple of years to provide any benefit over using "paste".
33-
#
34-
# This crate is only used in a single place in the xtask package inside the declarative
35-
# "write_crd" macro. The impact of vulnerabilities, if any, should be fairly minimal.
36-
#
37-
# See thread: https://users.rust-lang.org/t/paste-alternatives/126787/4
38-
#
39-
# This can only be removed again if we decide to use a different crate.
40-
"RUSTSEC-2024-0436",
28+
# https://rustsec.org/advisories/RUSTSEC-2024-0436
29+
# The "paste" crate is no longer maintained because the owner states that the implementation is
30+
# finished. There are at least two (forked) alternatives which state to be maintained. They'd
31+
# need to be vetted before a potential switch. Additionally, they'd need to be in a maintained
32+
# state for a couple of years to provide any benefit over using "paste".
33+
#
34+
# This crate is only used in a single place in the xtask package inside the declarative
35+
# "write_crd" macro. The impact of vulnerabilities, if any, should be fairly minimal.
36+
#
37+
# See thread: https://users.rust-lang.org/t/paste-alternatives/126787/4
38+
#
39+
# This can only be removed again if we decide to use a different crate.
40+
"RUSTSEC-2024-0436",
4141

42-
# https://rustsec.org/advisories/RUSTSEC-2026-0097
43-
# rand 0.8.5 is unsound when log+thread_rng features are enabled and a custom logger calls rand::rng().
44-
#
45-
# This version is pulled in transitively via num-bigint-dig -> rsa -> stackable-certs and cannot be
46-
# updated until the upstream rsa crate bumps its rand dependency.
47-
"RUSTSEC-2026-0097",
42+
# https://rustsec.org/advisories/RUSTSEC-2026-0097
43+
# rand 0.8.5 is unsound when log+thread_rng features are enabled and a custom logger calls rand::rng().
44+
#
45+
# This version is pulled in transitively via num-bigint-dig -> rsa -> stackable-certs and cannot be
46+
# updated until the upstream rsa crate bumps its rand dependency.
47+
"RUSTSEC-2026-0097",
4848

49-
# https://rustsec.org/advisories/RUSTSEC-2026-0173
50-
# The author of `proc-macro-error2` has [confirmed](https://github.com/GnomedDev/proc-macro-error-2/issues/17#issuecomment-4643215473)
51-
# that the crate is no longer maintained and recommends that users migrate away from it.
52-
#
53-
# There currently is no way for us to negate this advisory, because that crate is not used
54-
# directly by us. We need to wait for new versions of oci-spec and getset. See the following
55-
# issue which tracks moving to a newer getset version: https://github.com/youki-dev/oci-spec-rs/issues/340
56-
#
57-
# proc-macro-error2 v2.0.1
58-
# └── getset v0.1.6
59-
# └── oci-spec v0.9.0
60-
# └── boil v0.2.1
61-
#
62-
# Alternate crates are:
63-
#
64-
# - https://crates.io/crates/manyhow
65-
# - https://github.com/SergioBenitez/proc-macro2-diagnostics
66-
"RUSTSEC-2026-0173",
49+
# https://rustsec.org/advisories/RUSTSEC-2026-0173
50+
# The author of `proc-macro-error2` has [confirmed](https://github.com/GnomedDev/proc-macro-error-2/issues/17#issuecomment-4643215473)
51+
# that the crate is no longer maintained and recommends that users migrate away from it.
52+
#
53+
# There currently is no way for us to negate this advisory, because that crate is not used
54+
# directly by us. We need to wait for new versions of oci-spec and getset. See the following
55+
# issue which tracks moving to a newer getset version: https://github.com/youki-dev/oci-spec-rs/issues/340
56+
#
57+
# proc-macro-error2 v2.0.1
58+
# └── getset v0.1.6
59+
# └── oci-spec v0.9.0
60+
# └── boil v0.2.1
61+
#
62+
# Alternate crates are:
63+
#
64+
# - https://crates.io/crates/manyhow
65+
# - https://github.com/SergioBenitez/proc-macro2-diagnostics
66+
"RUSTSEC-2026-0173",
6767
]
6868

6969
[bans]
@@ -73,37 +73,43 @@ multiple-versions = "allow"
7373
unused-allowed-license = "allow"
7474
confidence-threshold = 1.0
7575
allow = [
76-
"Apache-2.0",
77-
"BSD-2-Clause",
78-
"BSD-3-Clause",
79-
"CC0-1.0",
80-
"ISC",
81-
"LicenseRef-ring",
82-
"LicenseRef-webpki",
83-
"MIT",
84-
"MPL-2.0",
85-
"OpenSSL", # Needed for the ring and/or aws-lc-sys crate. See https://github.com/stackabletech/operator-templating/pull/464 for details
86-
"Unicode-3.0",
87-
"Unicode-DFS-2016",
88-
"Zlib",
89-
"Unlicense",
76+
"Apache-2.0",
77+
"BSD-2-Clause",
78+
"BSD-3-Clause",
79+
"CC0-1.0",
80+
"ISC",
81+
"LicenseRef-ring",
82+
"LicenseRef-webpki",
83+
"MIT",
84+
"MPL-2.0",
85+
"OpenSSL", # Needed for the ring and/or aws-lc-sys crate. See https://github.com/stackabletech/operator-templating/pull/464 for details
86+
"Unicode-3.0",
87+
"Unicode-DFS-2016",
88+
"Zlib",
89+
"Unlicense",
9090
]
9191
private = { ignore = true }
9292

9393
[[licenses.clarify]]
9494
name = "ring"
9595
expression = "LicenseRef-ring"
96-
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
96+
license-files = [
97+
{ path = "LICENSE", hash = 0xbd0eed23 },
98+
]
9799

98100
[[licenses.clarify]]
99101
name = "webpki"
100102
expression = "LicenseRef-webpki"
101-
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]
103+
license-files = [
104+
{ path = "LICENSE", hash = 0x001c7e6c },
105+
]
102106

103107
[sources]
104108
unknown-registry = "deny"
105109
unknown-git = "deny"
106-
allow-git = ["https://github.com/kube-rs/kube-rs"]
110+
allow-git = [
111+
"https://github.com/kube-rs/kube-rs",
112+
]
107113

108114
[sources.allow-org]
109115
github = ["stackabletech"]

0 commit comments

Comments
 (0)