2022-11-17 02:53:35 +00:00
|
|
|
[advisories]
|
|
|
|
|
db-path = "~/.cargo/advisory-db"
|
|
|
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
|
|
|
|
|
|
|
|
vulnerability = "deny"
|
|
|
|
|
yanked = "deny"
|
|
|
|
|
notice = "warn"
|
|
|
|
|
unmaintained = "warn"
|
|
|
|
|
|
|
|
|
|
ignore = [
|
|
|
|
|
"RUSTSEC-2020-0071", # https://github.com/chronotope/chrono/issues/602
|
2023-01-13 22:44:20 +00:00
|
|
|
"RUSTSEC-2021-0139", # https://github.com/serai-dex/serai/228
|
|
|
|
|
"RUSTSEC-2022-0061", # https://github.com/serai-dex/serai/227
|
2022-11-17 02:53:35 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[licenses]
|
|
|
|
|
unlicensed = "deny"
|
|
|
|
|
|
|
|
|
|
allow = [
|
|
|
|
|
# Effective public domain
|
|
|
|
|
"CC0-1.0",
|
|
|
|
|
"Unlicense",
|
|
|
|
|
|
|
|
|
|
# Attribution required
|
|
|
|
|
"MIT",
|
2023-04-09 06:34:31 +00:00
|
|
|
"MITNFA",
|
2022-11-17 02:53:35 +00:00
|
|
|
"BSD-2-Clause",
|
|
|
|
|
"BSD-3-Clause",
|
|
|
|
|
"ISC",
|
|
|
|
|
"Unicode-DFS-2016",
|
|
|
|
|
"OpenSSL",
|
|
|
|
|
|
|
|
|
|
# Non-invasive copyleft
|
|
|
|
|
"MPL-2.0",
|
|
|
|
|
"Apache-2.0",
|
|
|
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
|
|
|
"GPL-3.0 WITH Classpath-exception-2.0",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
copyleft = "deny"
|
|
|
|
|
allow-osi-fsf-free = "neither"
|
|
|
|
|
default = "deny"
|
|
|
|
|
|
|
|
|
|
exceptions = [
|
2023-07-17 04:50:46 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-env" },
|
|
|
|
|
|
2022-11-17 02:53:35 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "ethereum-serai" },
|
|
|
|
|
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-message-queue" },
|
2023-07-03 11:09:35 +00:00
|
|
|
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-processor-messages" },
|
|
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-processor" },
|
2023-01-05 03:52:41 +00:00
|
|
|
|
2023-04-11 14:18:31 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "tributary-chain" },
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-coordinator" },
|
2023-04-11 13:21:35 +00:00
|
|
|
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-tokens-pallet" },
|
2023-01-28 06:47:13 +00:00
|
|
|
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-in-instructions-pallet" },
|
2023-01-20 16:00:18 +00:00
|
|
|
|
2023-07-03 12:09:41 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-validator-sets-pallet" },
|
2022-11-17 02:53:35 +00:00
|
|
|
|
|
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-runtime" },
|
|
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-node" },
|
2023-01-20 16:00:18 +00:00
|
|
|
|
|
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-client" },
|
2023-07-20 23:34:10 +00:00
|
|
|
|
2023-07-21 18:01:58 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-docker-tests" },
|
2023-07-20 23:34:10 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-message-queue-tests" },
|
2023-07-21 18:01:58 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-processor-tests" },
|
2023-08-01 23:00:48 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-coordinator-tests" },
|
2023-07-28 02:09:04 +00:00
|
|
|
{ allow = ["AGPL-3.0"], name = "serai-reproducible-runtime-tests" },
|
2022-11-17 02:53:35 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[[licenses.clarify]]
|
|
|
|
|
name = "ring"
|
|
|
|
|
version = "*"
|
|
|
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
|
|
|
license-files = [
|
|
|
|
|
{ path = "LICENSE", hash = 0xbd0eed23 }
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[bans]
|
|
|
|
|
multiple-versions = "warn"
|
|
|
|
|
wildcards = "warn"
|
|
|
|
|
highlight = "all"
|
cargo update
Achieves three notable updates.
1) Resolves RUSTSEC-2022-0093 by updating libp2p-identity.
2) Removes 3 old rand crates via updating ed25519-dalek (a dependency of
libp2p-identity).
3) Sets serde_derive to 1.0.171 via updating to time 0.3.26 which pins at up to
1.0.171.
The last one is the most important. The former two are niceties.
serde_derive, since 1.0.171, ships a non-reproducible binary blob in what's a
complete compromise of supply chain security. This is done in order to reduce
compile times, yet also for the maintainer of serde (dtolnay) to leverage
serde's position as the 8th most downloaded crate to attempt to force changes
to the Rust build pipeline.
While dtolnay's contributions to Rust are respectable, being behind syn, quote,
and proc-macro2 (the top three crates by downloads), along with thiserror,
anyhow, async-trait, and more (I believe also being part of the Rust project),
they have unfortunately decided to refuse to listen to the community on this
issue (or even engage with counter-commentary). Given their political agenda
they seem to try to be accomplishing with force, I'd go as far as to call their
actions terroristic (as they're using the threat of the binary blob as
justification for cargo to ship 'proper' support for binary blobs).
This is arguably representative of dtolnay's past work on watt. watt was a wasm
interpreter to execute a pre-compiled proc macro. This would save the compile
time of proc macros, yet sandbox it so a full binary did not have to be run.
Unfortunately, watt (while decreasing compile times) fails to be a valid
solution to supply chain security (without massive ecosystem changes). It never
implemented reproducible builds for its wasm blobs, and a malicious wasm blob
could still fundamentally compromise a project. The only solution for an end
user to achieve a secure pipeline would be to locally build the project,
verifying the blob aligns, yet doing so would negate all advantages of the
blob.
dtolnay also seems to be giving up their role as a FOSS maintainer given that
serde no longer works in several environments. While FOSS maintainers are not
required to never implement breaking changes, the version number is still 1.0.
While FOSS maintainers are not required to follow semver, releasing a very
notable breaking change *without a new version number* in an ecosystem which
*does follow semver*, then refusing to acknowledge bugs as bugs with their work
does meet my personal definition of "not actively maintaining their existing
work". Maintenance would be to fix bugs, not introduce and ignore.
For now, serde > 1.0.171 has been banned. In the future, we may host a fork
without the blobs (yet with the patches). It may be necessary to ban all of
dtolnay's maintained crates, if they continue to force their agenda as such,
yet I hope this may be resolved within the next week or so.
Sources:
https://github.com/serde-rs/serde/issues/2538 - Binary blob discussion
This includes several reports of various workflows being broken.
https://github.com/serde-rs/serde/issues/2538#issuecomment-1682519944
dtolnay commenting that security should be resolved via Rust toolchain edits,
not via their own work being secure. This is why I say they're trying to
leverage serde in a political game.
https://github.com/serde-rs/serde/issues/2526 - Usage via git broken
dtolnay explicitly asks the submitting user if they'd be willing to advocate
for changes to Rust rather than actually fix the issue they created. This is
further political arm wrestling.
https://github.com/serde-rs/serde/issues/2530 - Usage via Bazel broken
https://github.com/serde-rs/serde/issues/2575 - Unverifiable binary blob
https://github.com/dtolnay/watt - dtolnay's prior work on precompilation
2023-08-19 05:14:01 +00:00
|
|
|
deny = [ { name = "serde_derive", version = ">=1.0.172" } ]
|
2022-11-17 02:53:35 +00:00
|
|
|
|
|
|
|
|
[sources]
|
|
|
|
|
unknown-registry = "deny"
|
|
|
|
|
unknown-git = "deny"
|
|
|
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
|
|
|
allow-git = [
|
2023-08-20 04:14:38 +00:00
|
|
|
"https://github.com/serai-dex/schnorrkel",
|
2023-04-09 06:34:31 +00:00
|
|
|
"https://github.com/serai-dex/substrate-bip39",
|
2022-11-17 02:53:35 +00:00
|
|
|
"https://github.com/serai-dex/substrate",
|
2023-06-29 08:14:29 +00:00
|
|
|
"https://github.com/monero-rs/base58-monero",
|
2022-11-17 02:53:35 +00:00
|
|
|
]
|