ci(security): decide yanked/unsound/unmaintained advisory posture (LAB-1152) - #71
Open
27Bslash6 wants to merge 2 commits into
Open
ci(security): decide yanked/unsound/unmaintained advisory posture (LAB-1152)#7127Bslash6 wants to merge 2 commits into
27Bslash6 wants to merge 2 commits into
Conversation
…B-1152) yanked: enforced — cargo audit --deny yanked on the weekly schedule run, where advisories against an unchanged lockfile belong; PR/push runs keep the warning so an upstream yank never blocks unrelated PRs. The schedule leg now also proves the yank check ran (cargo-audit 0.22.1 silently skips it and exits 0 when the crates.io index is unreachable — verified). unsound / unmaintained: stay warnings on every event. Neither class guarantees a fixed version exists (rand 0.8.5 via fred 9.4 + memcache 0.19 has no compatible upgrade today), so enforcement means an ignore-list treadmill. deny.toml scopes stay narrow: cargo audit already reports every transitive case from the verbatim lockfile each run. deny.toml's untracked TODO is replaced by the decision of record; README table and Makefile follow. cargo update -p chacha20 clears the one yanked crate (0.10.1 -> 0.10.2) so the enforced class is born green.
|
Important Approval pendingCodeRabbit has no unresolved comments, but it could not review the latest commit because the review limit was reached. Follow the review guidance in this comment to continue. Comment |
This comment has been minimized.
This comment has been minimized.
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
…lure (LAB-1152) Kody flagged the proof-of-run guard as brittle on a warm index cache. The premise is wrong — cargo-audit 0.22.1 prints 'Updating crates.io index' unconditionally before the fetch attempt (auditor.rs), so a fresh cache cannot suppress it; verified empirically cold and warm. But the review surfaced a real hole in the opposite direction: on index fetch/open failure the tool warns "couldn't update|open crates.io index", skips the yank check entirely, and exits 0 — and the guard's failure grep only matched "couldn't check", so the weekly enforcing run would go green on a skipped check (the attempt line prints before the failed fetch). Broaden the failure grep to all three skip signals; keep the attempt-line grep, which is what catches the check being disabled outright (e.g. a future -n).
Contributor
Author
|
@kody start-review |
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes LAB-1152.
Decision per advisory class
yankedschedulerun (cargo audit --deny yanked); warn on PR/pushcargo update -p; enforcement lives on the audit side because cargo-deny's feature-resolved graph pruned the actual yanked crate (chacha20, behind reqwest's unused quinn path) while audit saw it.unsoundunmaintaineddeny.tomlscopes stay narrow — widening to "all" would only duplicate what audit already reports from the verbatim lockfile every run.deny.toml's untracked TODO ("widening both scopes toallis open work, not covered") is replaced by this decision of record. README table and Makefile updated to match;make auditruns the strict form so a local pass covers every CI event.Yanked check proven to execute — and now self-proving
cachekit-lean: run 33334234173 (green, 2026-08-30) showsUpdating crates.io indexfollowed byWarning: yankedin the audit step — the check runs on that runner and detects real yanks; it just exited 0.cargo audit --deny yankedsilently skips the yank check and exits 0 — no warning at all. Total network loss fails closed (advisory DB fetch errors out). Since the weekly run is the sole enforcement point, its leg now requires positive evidence (Updating crates.io indexpresent, nocouldn't checkwarning) and fails otherwise. Fail-closed brittleness is confined to the schedule event — a wording change in the pinned tool can only redden the weekly run, never a PR.Green-on-clean proof (local, pinned tool versions 0.19.4 / 0.22.1)
cargo update -p chacha20→ 0.10.1 (yanked) → 0.10.2 (not yanked; crates.io checksum verified; sole dependent rand 0.10.2 wants^0.10).cargo check --all-features --lockedpasses.cargo deny --locked --all-features check→ exit 0:advisories ok, bans ok, licenses ok, sources ok(--lockedand--all-featurespreserved).cargo audit --deny yanked→ exit 0,warning: 3 allowed warnings found(the three unsound advisories that stay warn by decision: anyhow, rand 0.8.5, scc).Notes
deny.tomlas single decision of record, fixed the stale Makefile header, README row now covers push runs. No findings rejected.cargo audit; cachekit-core installs cargo-audit unpinned.