fix(supply-chain): green up cargo-deny — unbreak advisories gate + seed bans/licenses - #42
Merged
Merged
Conversation
…an + 7 tray-only GTK3 ignores cargo-deny-action evaluates with ALL features, so it pulls the optional `tray` GTK3 stack (libappindicator -> gtk3) and flagged 7 'gtk-rs GTK3 bindings - no longer maintained' advisories (RUSTSEC-2024-0412/0413/0415/0416/0418/0419/0420). Local 'cargo deny check' used default features and missed them, so the gate passed locally but failed on main right after #41 merged. - [graph] all-features = true: local + CI now analyze the same surface (no more blind spots). - ignore the 7 GTK3 advisories: optional `tray` feature only; gtk3-rs is EOL with no GTK4 tray path yet. Deletable at the source if we drop the tray feature (open question, tracked in #40). Verified: 'cargo deny check advisories' green locally with all-features. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
…sses Make 'cargo deny check bans licenses' green (the last red, warn-only job): licenses: - allow 5 permissive licenses surfaced by the full tree: 0BSD, BSL-1.0, NCSA, CDLA-Permissive-2.0, bzip2-1.0.6. - exceptions: GPL-3.0-or-later scoped to Zed's zlog/ztracing/ztracing_macro (pulled via gpui; compatible with our stricter AGPL-3.0). Copyleft stays per-crate, never tree-wide. - clarify 11 git crates that omit a license field, to the license their repo actually grants: helios-* = MIT (a16z/helios root LICENSE); railgun/common/crypto/userop-kit = MIT (ethereum/kohaku package.json). Verified by reading the sources. bans: - wildcards deny -> warn + allow-wildcard-paths: intra-workspace path deps and the UNPUBLISHED gpui git deps have no version to pin; Cargo.lock still pins every git dep to an exact rev. Verified locally with all-features (matching CI): advisories ok, bans ok, licenses ok, sources ok. Tracked in #40. https://claude.ai/code/session_01JewEHPGHCWy5DWnmLD9DGy
hellno
changed the title
This was referenced Jun 13, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gets all of CI green and makes both cargo-deny jobs honest.
1. Unbreak the blocking advisories gate (the regression from #41)
#41madecargo-deny-advisoriesblocking, but it went red onmainimmediately: the cargo-deny-action evaluates with all features, pulling the optionaltrayGTK3 stack and flagging 7gtk-rs GTK3 bindingsadvisories my default-feature local run never saw.[graph] all-features = true— local and CI now analyze the same surface; this class of blind spot can't recur.trayfeature only; gtk3-rs is EOL with no GTK4 tray path yet.2. Seed the hygiene gate so
cargo-deny-supply-chainpassesLicenses
0BSD,BSL-1.0,NCSA,CDLA-Permissive-2.0,bzip2-1.0.6.GPL-3.0-or-laterscoped via exceptions to Zed'szlog/ztracing/ztracing_macro(pulled via gpui; compatible with our stricter AGPL). Copyleft stays per-crate, never tree-wide.licensefield, to the license their repo actually grants (verified by reading the sources):helios-*= MIT (a16z/helios root LICENSE);railgun/common/crypto/userop-kit= MIT (ethereum/kohakupackage.json).Bans
wildcards:deny→warn+allow-wildcard-paths. Intra-workspacepathdeps and the unpublished gpui git deps have no version to pin;Cargo.lockstill pins every git dep to an exact rev.Verified
Locally with all-features (matching CI):
advisories ok, bans ok, licenses ok, sources ok.Note / follow-up
cargo-deny-supply-chainkeepscontinue-on-error: truein this PR. Once CI confirms it green here, the natural next step (separate) is to dropcontinue-on-errorso the hygiene gate also blocks — completing #40. The Helios bump to remove the webpki/hickory/rustls-pemfile ignores at the source remains the other #40 item.