mirrors/arti.git/maint/cargo_audit, branch arti-v1.2.0 mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v1.2.0 2024-02-19T12:29:53Z cargo_audit: Add an exception for RUSTSEC-2024-0014. 2024-02-19T12:29:53Z Gabriela Moldovan gabi@torproject.org 2024-02-19T11:45:21Z urn:sha1:1fd9077db406835277093caff745bbb8ce6bce05 We should migrate to `slotmap`, but in the meantime let's just add an exception to unblock CI. Restore deleted entries to OBSOLETE_IGNORE 2023-12-11T13:34:41Z Nick Mathewson nickm@torproject.org 2023-11-30T15:27:59Z urn:sha1:e3678842775c91b108f6efb5f0a771bcaab1b8e5 We should have added these to our record of previous rustsec ignores, but we accidentally removed them instead. Remove our cargo-audit exception for ed25519-dalek 2023-12-11T13:34:41Z Nick Mathewson nickm@torproject.org 2023-11-30T13:51:15Z urn:sha1:b3b8d7f10f2c99101ccc22379f36b831b8da5cff It's no longer necessary now that we have upgraded. Ignore rsa timing cargo-audit warning 2023-11-28T15:41:54Z Nick Mathewson nickm@torproject.org 2023-11-28T15:41:54Z urn:sha1:41a421d6a23e65052f84cca9496712387fd75b5e Merge branch 'clap4' into 'main' 2023-11-15T17:35:29Z gabi-250 gabi@torproject.org 2023-11-15T17:35:29Z urn:sha1:f286a66bcdc6ea37b45c6b4a3106ab8cdc48c040 Upgrade to clap 4 See merge request tpo/core/arti!1735 Remove webpki cargo_audit exception 2023-11-15T15:05:55Z Nick Mathewson nickm@torproject.org 2023-11-15T15:05:55Z urn:sha1:805d5799b6f1bdd4d841466188b44eb8a3e51b00 Apparently webpki came out of retirement and actually fixed RUSTSEC-2023-0052. Versions >=0.22.2 should be fine. cargo_audit: Remove note about clap use of atty. 2023-11-15T14:46:45Z Nick Mathewson nickm@torproject.org 2023-11-15T14:46:45Z urn:sha1:ae5d28d196174b7424358ca1275ce82cd02b3ddc Add a cargo-audit exception for RUSTSEC-2023-0052 2023-08-22T14:00:02Z Nick Mathewson nickm@torproject.org 2023-08-22T14:00:02Z urn:sha1:55bc2977049a54f20c7b12be6e262c35f00e6293 We've solved this for rustls-webpki, but tls-api (which arti-hyper uses) still requires the unmaintained webpki crate. See #1016. cargo_audit: Add an exception for RUSTSEC-2022-0093. 2023-08-14T18:15:15Z Nick Mathewson nickm@torproject.org 2023-08-14T18:15:15Z urn:sha1:875de204e9d004b66b81203b6335b4abb7365202 This is the API deficiency in ed25519-dalek v1 that allows you to mismatch public and private keys, leading to a (fatal) double-signing attack. We have worked around this in our current design, so it's appropriate to suppress this warning for now. cargo audit: un-ignore RUSTSEC-2023-0040 ("`users` is unmaintained" 2023-07-14T15:02:45Z Ian Jackson ijackson@chiark.greenend.org.uk 2023-07-14T15:01:39Z urn:sha1:1d644d29237ab268c94ae34ae74bf75816bed614