estate/osv-scanner.toml
# osv-scanner's triage for the Cargo.lock beside this file (OpenSSF Scorecard's
# Vulnerabilities check reads it). The policy is deny.toml's [advisories] ignore at the
# repository root; xtask/tests/ossf_scorecard.rs holds the two equal. Each entry expires
# at ignoreUntil and is then looked at again.
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa Marvin timing side channel, no upstream fix. Holger runs no rsa private-key operation an attacker can time: server-lib's rsa only makes the APK key once (ring signs), the other copies verify. Mirrors deny.toml (triaged 2026-10-30, lane OSSF-NEXT)."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0387"
ignoreUntil = 2027-01-31
reason = "crypto-bigint 0.5.5 timing, fixed only in 0.7.6+: the 0.5 copy enters via cx448 under pgp =0.21.0 (verify only) and elliptic-curve 0.13 (p256/p384 0.13, mostly verify; the server's own P-256 signatures are not attacker-timed). Mirrors deny.toml (re-triaged 2026-10-30, lane OSSF-NEXT)."
[[IgnoredVulns]]
id = "GHSA-q54r-jf2p-rfr2"
ignoreUntil = 2027-01-31
reason = "gix 0.88 .git-protection via an untrusted .git/config, via nornir-git 0.2.3 (the edda sibling) in the build/CI tooling only, which opens only the house's own repositories; no Holger server links it. gix 0.90 = row GIX-090. Mirrors deny.toml (triaged 2026-10-30, lane OSSF-NEXT)."