xtask/tests/fixtures/cve_vulnerable/Cargo.toml
# A DELIBERATELY VULNERABLE workspace. It exists so the 0-known-CVE gate can be
# seen to go RED (measure, never assert): a dependency tree carrying a real, published RustSec
# advisory MUST be refused, and the gate MUST name the advisory.
#
# The vuln is rsa 0.10.0-rc.18 -> RUSTSEC-2023-0071 (the Marvin Attack timing
# sidechannel). It is pinned exactly so the fixture is stable: a version bump
# cannot silently make the advisory stop applying and the test go quietly green.
#
# It is a workspace of its own, excluded from gunnar's root workspace, and
# nothing in gunnar depends on it. cargo-deny resolves its committed Cargo.lock;
# nothing builds it. `deny.toml` here has an EMPTY `ignore`, so the advisory is
# not excused — the whole point is that it fires.
[workspace]
resolver = "2"
members = ["vulnerable"]