Skip to content

Commit

Permalink
Switch imported audits from Mozilla (#807)
Browse files Browse the repository at this point in the history
  • Loading branch information
@divergentdave
divergentdave authored Oct 23, 2023
1 parent 9ccb045 commit c56ef42
Show file tree
Hide file tree
Showing 2 changed files with 121 additions and 99 deletions.
6 changes: 3 additions & 3 deletions supply-chain/config.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@ url = "https://raw.githubusercontent.com/EmbarkStudios/rust-ecosystem/main/audit
[imports.fermyon]
url = "https://raw.githubusercontent.com/fermyon/spin/main/supply-chain/audits.toml"

[imports.firefox]
url = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[imports.google]
url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"

[imports.isrg]
url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"

[imports.mozilla]
url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"

[imports.zcash]
url = "https://raw.githubusercontent.com/zcash/rust-ecosystem/main/supply-chain/audits.toml"

Expand Down
214 changes: 118 additions & 96 deletions supply-chain/imports.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -352,38 +352,122 @@ who = "Radu Matei <[email protected]>"
criteria = "safe-to-run"
version = "0.3.3"

[[audits.firefox.audits.autocfg]]
[[audits.google.audits.clap]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "4.0.32"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
delta = "4.0.32 -> 4.1.14"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap_builder]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "4.1.14"
notes = """
This was a diff audit between clap 4.0.32 sources, and sources in clap_builder
4.1.14. clap_builder is primarily stuff refactored out of `clap`.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap_lex]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "0.4.1"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.hex]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.4.3"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.io-lifetimes]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "1.0.10"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.itertools]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.10.5"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.lazy_static]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "1.4.0"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.log]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.4.17"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.same-file]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "1.0.6"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.version_check]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-deploy"
version = "0.9.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.walkdir]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "2.3.2"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[audits.isrg.audits]

[[audits.mozilla.audits.autocfg]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.block-buffer]]
[[audits.mozilla.audits.block-buffer]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.10.2 -> 0.10.3"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.crypto-common]]
[[audits.mozilla.audits.crypto-common]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.1.3 -> 0.1.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.digest]]
[[audits.mozilla.audits.digest]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.10.3 -> 0.10.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.either]]
[[audits.mozilla.audits.either]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "1.6.1 -> 1.7.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.either]]
[[audits.mozilla.audits.either]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "1.7.0 -> 1.8.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.half]]
[[audits.mozilla.audits.half]]
who = "John M. Schanck <[email protected]>"
criteria = "safe-to-deploy"
version = "1.8.2"
Expand All @@ -392,155 +476,93 @@ This crate contains unsafe code for bitwise casts to/from binary16 floating-poin
format. I've reviewed these and found no issues. There are no uses of ambient
capabilities.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.hermit-abi]]
[[audits.mozilla.audits.hermit-abi]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.2.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.hex]]
who = "Simon Friedberger <[email protected]>"
criteria = "safe-to-deploy"
version = "0.4.3"

[[audits.firefox.audits.log]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
version = "0.4.17"

[[audits.firefox.audits.num-bigint]]
[[audits.mozilla.audits.num-bigint]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "0.4.3"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.num-integer]]
[[audits.mozilla.audits.num-integer]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "0.1.45"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.num-iter]]
[[audits.mozilla.audits.num-iter]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "0.1.43"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.num-rational]]
[[audits.mozilla.audits.num-rational]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "0.4.1"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.num-traits]]
[[audits.mozilla.audits.num-traits]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "0.2.15"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rand_core]]
[[audits.mozilla.audits.rand_core]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.6.3 -> 0.6.4"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rayon]]
[[audits.mozilla.audits.rayon]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "1.5.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rayon]]
[[audits.mozilla.audits.rayon]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "1.5.3 -> 1.6.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rayon-core]]
[[audits.mozilla.audits.rayon-core]]
who = "Josh Stone <[email protected]>"
criteria = "safe-to-deploy"
version = "1.9.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rayon-core]]
[[audits.mozilla.audits.rayon-core]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "1.9.3 -> 1.10.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.rayon-core]]
[[audits.mozilla.audits.rayon-core]]
who = "Mike Hommey <[email protected]>"
criteria = "safe-to-deploy"
delta = "1.10.1 -> 1.10.2"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.firefox.audits.subtle]]
[[audits.mozilla.audits.subtle]]
who = "Simon Friedberger <[email protected]>"
criteria = "safe-to-deploy"
version = "2.5.0"
notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation."

[[audits.google.audits.clap]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "4.0.32"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
delta = "4.0.32 -> 4.1.14"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap_builder]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "4.1.14"
notes = """
This was a diff audit between clap 4.0.32 sources, and sources in clap_builder
4.1.14. clap_builder is primarily stuff refactored out of `clap`.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.clap_lex]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "0.4.1"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.io-lifetimes]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-run"
version = "1.0.10"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.itertools]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.10.5"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.lazy_static]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "1.4.0"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.same-file]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "1.0.6"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.version_check]]
who = "George Burgess IV <[email protected]>"
criteria = "safe-to-deploy"
version = "0.9.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[[audits.google.audits.walkdir]]
who = "Android Legacy"
criteria = "safe-to-run"
version = "2.3.2"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

[audits.isrg.audits]
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"

[[audits.zcash.audits.getrandom]]
who = "Jack Grigg <[email protected]>"
Expand Down

0 comments on commit c56ef42

Please sign in to comment.