deny.toml
# cargo-deny policy for monetize (lane OX-CVE, 2026-10-28): the same "0 known advisory" check
# gunnar's `cargo xtask cve` runs, `cargo deny --no-default-features check advisories`, on this
# repository's root Cargo.lock.
#
# Every `ignore` below is a triaged, dated decision with no fixed release to move to — NOT a
# blanket mute. A new advisory, or a fix arriving for one of these, fails the check by name
# (cargo-deny warns "advisory was not encountered" for an ignore that has gone stale: remove it).
[advisories]
version = 2
yanked = "deny"
ignore = [
# RUSTSEC-2026-0387 — crypto-bigint timing variability. Crate: crypto-bigint 0.5.5, fixed
# only in 0.7.6+. It enters through RustCrypto's elliptic-curve 0.13 line (p256/p384/p521
# 0.13 via ssh-key 0.6, nornir-auth-webauthn and znippy-common), which has no release on
# crypto-bigint 0.7. monetize VERIFIES with those curves (passkey assertions, SSH and
# sshsig signatures: public keys and public signatures, no secret integer); its only P-256
# signing is the soft authenticator in monetize-ui-server's tests, with a fixed test key.
# Re-check when ssh-key 0.7 / elliptic-curve 0.14 reach this tree.
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 via elliptic-curve 0.13 (p256/p384/p521 for ssh-key 0.6, webauthn, znippy-common): no 0.5 fix. monetize only verifies with these curves (public data); P-256 signing is test-only. Triaged 2026-10-28; re-check at ssh-key 0.7." },
# RUSTSEC-2024-0436 — paste is unmaintained (not a vulnerability). Crate: paste 1.0.15,
# no maintained release. A compile-time proc-macro of leptos (either_of, reactive_graph)
# for monetize-ui-web; links into no binary. Re-check at every leptos bump.
{ id = "RUSTSEC-2024-0436", reason = "paste 1.0.15 is unmaintained (no vulnerability): a compile-time proc-macro of leptos 0.8 (monetize-ui-web). Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every leptos bump." },
# RUSTSEC-2026-0173 — proc-macro-error2 is unmaintained (not a vulnerability). Crate:
# proc-macro-error2 2.0.1, no maintained release. A compile-time proc-macro of syn_derive
# -> rstml -> leptos_macro / leptos_hot_reload (monetize-ui-web); links into no binary.
{ id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 2.0.1 is unmaintained (no vulnerability): a compile-time proc-macro under leptos_macro (rstml, syn_derive) for monetize-ui-web. Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every leptos bump." },
# The two below are not in the root lock; they are in the DETACHED workspaces' locks
# (xtask, crates/monetize-fast, crates/monetize-build-thing, crates/monetize-admin), which
# cargo-deny checks with this same file when run in their directories.
#
# RUSTSEC-2023-0071 — Marvin timing side channel in rsa. No fixed version exists. rsa
# enters through russh's default `rsa` feature (nornir-git: the xtask tooling, the fast
# test, the build thing's git fetch) and ssh-key. monetize mints and signs with ed25519
# keys only; the side channel needs an attacker timing RSA private-key operations, and
# none of these paths performs one where anyone but the trusted far end could observe it
# (the same triage as gunnar's deny.toml, 2026-08-31).
{ id = "RUSTSEC-2023-0071", reason = "rsa has no fix: only via russh's default rsa feature (nornir-git: xtask, monetize-fast, the build thing) and ssh-key, in the detached workspaces. monetize's keys are ed25519; no RSA private-key op on an attacker-observable path. Triaged 2026-10-28 (as gunnar 2026-08-31)." },
# RUSTSEC-2026-0374 — basic-toml is unmaintained (not a vulnerability), no maintained
# release. Only in crates/monetize-admin's lock: a compile-time dependency of i18n-config
# 0.4.8 (the newest), read by the i18n proc-macros `age` 0.11.5 needs unconditionally. It
# parses the build's own i18n.toml and links into no binary (as gunnar's deny.toml).
{ id = "RUSTSEC-2026-0374", reason = "basic-toml 0.1.10 is unmaintained (no vulnerability): only a compile-time dependency of i18n-config 0.4.8 (newest) under age 0.11.5's i18n proc-macros (monetize-admin). Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every age bump." },
# MON-OSSF (2026-10-31): the advisories OSV-Scanner (and so the OpenSSF Scorecard) counts in the
# tooling locks (xtask, crates/monetize-fast, crates/monetize-build-thing): all under nornir-git
# (gix, russh), none in a monetize binary. The same ids, reasons and dates are in the
# osv-scanner.toml beside each lock (xtask/tests/osv_triage.rs). wasmtime 49.0.5
# (RUSTSEC-2026-0422/0423/0424) and pageant 0.2.5 (GHSA-662x-8wvj-2276) were FIXED by a lock
# move instead; the same test keeps those floors.
{ id = "GHSA-q54r-jf2p-rfr2", reason = "gix 0.88.0 (fixed in 0.90): only under nornir-git 0.2.1 from crates.io in the tooling workspaces xtask and monetize-fast, never in a monetize binary (the build thing follows edda's nornir-git on gix 0.90 since GIX-090). The advisory lets an untrusted .git/config switch off the protectHFS/protectNTFS path checks, which guard case-insensitive macOS/Windows checkouts; the tooling clones monetize's own repositories from git.gunnar.rs onto Linux filesystems. Gone with the next nornir-git publish and a lock follow (GIX-090 / SSH-PUBLISH). Triaged 2026-10-31 (MON-OSSF)." },
{ id = "GHSA-vp5q-ff62-jwqv", reason = "russh's agent SERVER never calls Agent::confirm (fixed in russh 0.65): russh is only under nornir-git (xtask, monetize-fast, the build thing), which runs the agent CLIENT against the developer's own ssh-agent; no russh agent server runs anywhere in monetize. Re-check when edda's nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)." },
{ id = "GHSA-9wfm-jcj8-jfv9", reason = "russh's agent SERVER allocates without bound on repeated confirm constraints (fixed in russh 0.65): nornir-git runs only the agent client; no russh agent server runs in monetize or its tooling. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)." },
{ id = "GHSA-4p9f-7p9m-5vfg", reason = "russh's CLIENT allocates without bound on a server's EXT_INFO (fixed in russh 0.65): the client is nornir-git's, in the tooling workspaces only (xtask, monetize-fast, the build thing), and it dials only the forge's own git servers (git.gunnar.rs and dwarf's mirror); the worst case is a memory exhaustion of a tooling process by our own server. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)." },
{ id = "GHSA-fw5c-8223-6h42", reason = "russh: a peer's zero maximum packet size stalls channel writes (fixed in russh 0.65): only nornir-git's client in the tooling workspaces, which talks to the forge's own git servers; the worst case is a hung tooling push. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)." },
{ id = "GHSA-j7h2-66j4-ghjf", reason = "russh 0.63.3 (fixed in 0.64.0) only under nornir-git 0.2.1 from crates.io (xtask, monetize-fast), which uses russh::client and the agent client only; the advisory is a server-side publickey check. Gone with the nornir-git 0.2.3 publish (SSH-PUBLISH) and a lock follow. Triaged 2026-10-31 (MON-OSSF, as Gunnar 2026-10-30)." },
{ id = "GHSA-4wc5-f2rc-q74m", reason = "russh 0.63.3 (fixed in 0.64.1) only under nornir-git 0.2.1 (xtask, monetize-fast): the advisory is the agent-protocol server; nornir-git runs only the agent client. Gone with the nornir-git 0.2.3 publish (SSH-PUBLISH) and a lock follow. Triaged 2026-10-31 (MON-OSSF, as Gunnar 2026-10-30)." },
]
[sources]
unknown-registry = "deny"
unknown-git = "allow"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]