crates/monetize-build-thing/osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing side channel) has no fixed release: it enters through russh/ssh-key (nornir-git in xtask, monetize-fast, the build thing) and ssh-key's rsa support; monetize mints and signs with ed25519 keys only, so no attacker-observable path does an RSA private-key operation. Triaged 2026-10-28 (as Gunnar 2026-08-31), re-checked 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-4p9f-7p9m-5vfg"
ignoreUntil = 2027-01-31
reason = "russh's CLIENT allocates without bound on a server's EXT_INFO (fixed in russh 0.65): the client is nornir-git's, in the tooling workspaces only (xtask, monetize-fast, the build thing), and it dials only the forge's own git servers (git.gunnar.rs and dwarf's mirror); the worst case is a memory exhaustion of a tooling process by our own server. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-9wfm-jcj8-jfv9"
ignoreUntil = 2027-01-31
reason = "russh's agent SERVER allocates without bound on repeated confirm constraints (fixed in russh 0.65): nornir-git runs only the agent client; no russh agent server runs in monetize or its tooling. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-fw5c-8223-6h42"
ignoreUntil = 2027-01-31
reason = "russh: a peer's zero maximum packet size stalls channel writes (fixed in russh 0.65): only nornir-git's client in the tooling workspaces, which talks to the forge's own git servers; the worst case is a hung tooling push. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-vp5q-ff62-jwqv"
ignoreUntil = 2027-01-31
reason = "russh's agent SERVER never calls Agent::confirm (fixed in russh 0.65): russh is only under nornir-git (xtask, monetize-fast, the build thing), which runs the agent CLIENT against the developer's own ssh-agent; no russh agent server runs anywhere in monetize. Re-check when edda's nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."