From 085612cc5ca1fda0d56ded145390cba4d8623b74 Mon Sep 17 00:00:00 2001 From: Christophe Pettus Date: Tue, 4 Aug 2026 18:21:56 -0700 Subject: [PATCH] docs(ci): correct the cargo-audit rationale to the real dependency surface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment justifying the scope of the supply-chain gate said the root crate ships "only `xxhash-rust` and `libc` as production deps — both well-maintained — so the practical risk surface is small". That has been false since encryption landed. The root [dependencies] block lists nine direct production deps, six of them cryptographic, and they are unconditional — there is no encryption feature gate, so the seal/open code is always compiled. The audit surface is the whole RustCrypto AEAD/KDF stack and its transitives. It is false in the direction that matters: a reader deciding whether `cargo audit` alone is sufficient makes that call from the comment, and a two-dependency picture argues for less tooling than a crypto stack does. Also records the two MSRV-motivated downgrade pins (`zeroize = "~1.8"`, `base64ct = "~1.6"`, both held below edition2024 releases to keep the 1.82 floor the msrv job enforces). Deliberately held back means deliberately not receiving upstream fixes, and nothing else in CI would surface that — so they belong in the comment that decides how much supply-chain scrutiny this repo applies. Leaves the open question stated rather than answered: there is no deny.toml, so nothing gates on licenses, duplicate versions or banned crates. Defensible for two leaf utilities, a bigger call for the current tree. Closes #125. --- .github/workflows/ci.yml | 38 +++++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 51bd706..9f2faf1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,11 +63,39 @@ jobs: - name: Check formatting run: cargo fmt -- --check - # I54 (ISSUES.md, 2026-05-22): supply-chain advisory check via cargo-audit. - # Runs against the RustSec advisory database. Currently the root crate - # ships with only `xxhash-rust` and `libc` as production deps — both - # well-maintained — so the practical risk surface is small. Catches any - # vulnerable transitive dep that creeps in via a future change. + # I54 (ISSUES.md, 2026-05-22): supply-chain advisory check via cargo-audit, + # run against the RustSec advisory database. + # + # This comment is the recorded reason the repo runs this much supply-chain + # tooling and no more, so it has to describe the tree that actually exists. + # It used to say the root crate ships "only `xxhash-rust` and `libc` as + # production deps — both well-maintained — so the practical risk surface is + # small". That stopped being true when on-disk encryption landed. The root + # `[dependencies]` block now lists NINE direct production deps: + # + # xxhash-rust, libc, rustc-hash, + # chacha20poly1305, argon2, hkdf, sha2, zeroize, getrandom + # + # Six of those are cryptographic, and they are unconditional — the seal/open + # code is always compiled, there is no `encryption` feature gate. So the + # audit surface is the whole RustCrypto AEAD/KDF stack plus its transitives, + # not two leaf utilities. + # + # Two of the pins are held BELOW their current releases to preserve the 1.82 + # MSRV that the `msrv` job enforces: + # + # * `zeroize = "~1.8"` — 1.9.0 went edition2024 (needs 1.85+) + # * `base64ct = "~1.6"` — 1.7+ went edition2024; floor-pinned because + # argon2 0.5.3 depends on it transitively + # + # Deliberately held back means deliberately not receiving upstream fixes, so + # both are items to re-check whenever this job flags an advisory, and to lift + # when the MSRV floor moves past 1.85 (both Cargo.toml comments say so too). + # + # Still worth a decision: `cargo audit` covers advisories only. There is no + # deny.toml, so nothing gates on licenses, duplicate versions, or banned + # crates. That was a defensible call for a two-dependency tree; it is a more + # substantial one now that the crate pulls a full crypto stack. # # Permissions notes: # * `pull-requests: write` lets the action post per-line annotations