ci(supply-chain): blocking cargo-deny advisories gate + triaged transitive advisories - #41
Merged
Merged
Conversation
…ia exception Add written, justified [advisories].ignore entries for all 12 transitive advisories (none has an in-tree fix): the rustls-webpki TLS trio + hickory DNS DoS pair (via the Helios/jsonrpsee/reqwest stack, tracked in #40) and 7 unmaintained build-time/transitive crates. This lets 'cargo deny check advisories' pass so it can be promoted to a blocking CI gate. Accept openssl via documented exception (Helios hard-pulls it via native-tls; unremovable without an upstream change -> #40); drop it from [bans].deny. Verified with cargo-deny 0.19.8: 'cargo deny check advisories' is green. Note: the CI job split (advisories blocking) + daily audit workflow are applied separately (this token lacks GitHub 'workflows' permission to push under .github/workflows/). https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
This GitHub App token lacks the 'workflows' permission, so it cannot push the
.github/workflows/ changes that make the advisories check a blocking gate. Capture
them here instead, appliable with:
git apply docs/supply-chain-ci-split.patch
Contents: split the single non-blocking cargo-deny job into a BLOCKING
cargo-deny-advisories job (check advisories) + a non-blocking cargo-deny-supply-chain
job (check bans/sources/licenses), and add .github/workflows/audit.yml (daily
'cargo deny check advisories' re-scan). Backs deny.toml + issue #40. Delete this file
once the workflow changes are applied.
https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
…tions deckard-mcp (AGPL-3.0-or-later) was missing from [licenses.exceptions] while the other four workspace crates (app/core/contract/signerd) were listed, so cargo-deny rejected its license. Add it. Verified: no first-party AGPL crate is rejected now. Part of #40. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
…rn-only hygiene Apply docs/supply-chain-ci-split.patch (the workflow changes the remote bot couldn't push for lack of GitHub 'workflows' permission), and delete the patch now that it's live: - cargo-deny-advisories (check advisories) -> BLOCKING security gate - cargo-deny-supply-chain (check bans/sources/licenses) -> non-blocking until seeded (#40) - .github/workflows/audit.yml: daily 'cargo deny check advisories' re-scan off-PR Backs the deny.toml advisory triage already on this branch. Bans/licenses seeding tracked in #40. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
…rn-only hygiene The workflow changes from docs/supply-chain-ci-split.patch (the prior commit only recorded the patch's deletion; this commit adds the actual workflow files): - cargo-deny-advisories (check advisories) -> BLOCKING security gate - cargo-deny-supply-chain (check bans/sources/licenses) -> non-blocking until seeded (#40) - .github/workflows/audit.yml: daily 'cargo deny check advisories' re-scan off-PR Backs the deny.toml advisory triage already on this branch. Bans/licenses seeding tracked in #40. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
hellno
added a commit
that referenced
this pull request
Jun 13, 2026
…ed bans/licenses (#42) * fix(supply-chain): unbreak blocking advisories gate — all-features scan + 7 tray-only GTK3 ignores cargo-deny-action evaluates with ALL features, so it pulls the optional `tray` GTK3 stack (libappindicator -> gtk3) and flagged 7 'gtk-rs GTK3 bindings - no longer maintained' advisories (RUSTSEC-2024-0412/0413/0415/0416/0418/0419/0420). Local 'cargo deny check' used default features and missed them, so the gate passed locally but failed on main right after #41 merged. - [graph] all-features = true: local + CI now analyze the same surface (no more blind spots). - ignore the 7 GTK3 advisories: optional `tray` feature only; gtk3-rs is EOL with no GTK4 tray path yet. Deletable at the source if we drop the tray feature (open question, tracked in #40). Verified: 'cargo deny check advisories' green locally with all-features. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy * fix(supply-chain): seed bans + licenses so cargo-deny-supply-chain passes Make 'cargo deny check bans licenses' green (the last red, warn-only job): licenses: - allow 5 permissive licenses surfaced by the full tree: 0BSD, BSL-1.0, NCSA, CDLA-Permissive-2.0, bzip2-1.0.6. - exceptions: GPL-3.0-or-later scoped to Zed's zlog/ztracing/ztracing_macro (pulled via gpui; compatible with our stricter AGPL-3.0). Copyleft stays per-crate, never tree-wide. - clarify 11 git crates that omit a license field, to the license their repo actually grants: helios-* = MIT (a16z/helios root LICENSE); railgun/common/crypto/userop-kit = MIT (ethereum/kohaku package.json). Verified by reading the sources. bans: - wildcards deny -> warn + allow-wildcard-paths: intra-workspace path deps and the UNPUBLISHED gpui git deps have no version to pin; Cargo.lock still pins every git dep to an exact rev. Verified locally with all-features (matching CI): advisories ok, bans ok, licenses ok, sources ok. Tracked in #40. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Turns the previously decorative cargo-deny job (
continue-on-error: true, blocked nothing) into a real blocking security gate, with every advisory triaged in writing.CI
cargo-deny-advisories(check advisories) → BLOCKING. A new, untriaged RustSec advisory now fails the check and blocks the merge.cargo-deny-supply-chain(check bans sources licenses) → stays non-blocking until the license/bans allow-lists are seeded (tracked in Supply-chain: bump Helios/reqwest TLS+DNS stack to clear webpki + hickory advisories; seed cargo-deny bans/licenses to blocking #40)..github/workflows/audit.yml→ dailycargo deny check advisoriesre-scan against the committedCargo.lock, so newly published advisories surface off-PR. (Schedule fires once merged tomain.)deny.toml
ignores — none has an in-tree fix:rustls-webpkiTLS trio (RUSTSEC-2026-0098/0099/0104) +hickoryDNS DoS pair (2026-0118/0119), all via the Helios → jsonrpsee 0.19 → rustls 0.21 / reqwest stack. Real fix = bump Helios (tracked in Supply-chain: bump Helios/reqwest TLS+DNS stack to clear webpki + hickory advisories; seed cargo-deny bans/licenses to blocking #40).rustls-pemfile,async-std,instant,derivative,paste,proc-macro-error,proc-macro-error2).native-tls; unremovable without the upstream bump) — dropped from[bans].deny.deckard-mcpadded to first-party AGPL[licenses.exceptions](the other 4 workspace crates were already listed).Why this isn't hand-waving over real holes
Custody never rests on TLS: Helios proof-checks every read against the consensus sync committee, signing is local in
deckard-signerd, and signed txs are self-authenticating. The webpki/hickory advisories are liveness/defense-in-depth on the transport, not fund-theft paths — but they're now documented, justified, and gated instead of silently ignored.Verification
cargo deny check advisoriesis green locally (cargo-deny 0.19.8) with the new ignore list. Both workflow files validate as YAML.Follow-ups (#40)
Seed the hygiene gate to blocking: wildcard path/git deps, permissive licenses (
0BSD/BSL-1.0/NCSA/CDLA-Permissive-2.0/bzip2), the GPL-3.0 Zed crates (needs an explicit allow decision), and ~12 unlicensed git crates via[licenses.clarify]. Plus the Helios bump to remove the webpki/hickory ignores at the source.To make the gate enforced, add
cargo-deny-advisoriesto branch protection onmain.