Skip to main content

max / makenotwork

server: add cargo-deny supply-chain gate deny.toml (advisories mirror .cargo/audit.toml; bans surfaces the x509/rustls duplicate clusters; sources fails on unsanctioned registry/git) wired into run-ci.sh step 5b as 'cargo deny check advisories bans sources', command -v-guarded. Crate marked publish=false so first-party path-dep wildcards pass. Licenses excluded until shared crates declare a license field. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-05 15:49 UTC
Commit: 1899933d410b272400232beb4ba25e3033cbea59
Parent: 4a8a23d
3 files changed, +94 insertions, -0 deletions
M server/Cargo.toml +3
@@ -3,6 +3,9 @@ name = "makenotwork"
3 3 version = "0.10.8"
4 4 edition = "2024"
5 5 license-file = "LICENSE"
6 + # Server binary — never published to a registry. Marks the crate private so
7 + # supply-chain tooling (cargo-deny) treats its first-party path deps correctly.
8 + publish = false
6 9
7 10 [features]
8 11 fast-tests = []
A server/deny.toml +79
@@ -0,0 +1,79 @@
1 + # cargo-deny configuration — supply-chain gate for the MNW server.
2 + #
3 + # Wired into `deploy/run-ci.sh` (step 5b) as `cargo deny check advisories bans
4 + # sources`. This complements `cargo audit`: `bans` surfaces duplicate-version
5 + # clusters (the x509/crypto and rustls dual stacks the audits flag), and
6 + # `sources` fails the build if any dependency is pulled from a registry or git
7 + # remote we did not sanction.
8 + #
9 + # The `licenses` check is intentionally NOT part of the gate command yet: three
10 + # first-party path crates (docengine, s3-storage, theme-common) ship without a
11 + # `license` field, which `cargo deny check licenses` rejects. Giving those
12 + # crates an explicit license (MIT for reusable infra, per the licensing
13 + # strategy) is a separate cleanup; the allow-list below is kept current so the
14 + # check can be switched on once that lands.
15 +
16 + [advisories]
17 + version = 2
18 + # Mirror of `.cargo/audit.toml` — every entry is a transitive advisory we cannot
19 + # resolve by bumping our own direct deps, kept in sync with the cargo-audit
20 + # posture. Directly-fixable advisories are fixed in Cargo.toml, never parked here.
21 + ignore = [
22 + "RUSTSEC-2023-0071", # rsa Marvin timing side-channel — only via signature *verification* crates; we never decrypt with rsa.
23 + "RUSTSEC-2026-0098", # rustls-webpki 0.101 — transitive via AWS S3 SDK rustls 0.21; only validates trusted S3/STS endpoints.
24 + "RUSTSEC-2026-0099", # rustls-webpki 0.101 — same AWS SDK TLS stack; clears when the SDK moves to rustls 0.23.
25 + "RUSTSEC-2026-0104", # rustls-webpki 0.101 CRL parse panic — same AWS SDK TLS stack, trusted endpoints only.
26 + "RUSTSEC-2026-0183", # git2 Remote::list UB — never called on untrusted input (repos are server-owned).
27 + "RUSTSEC-2026-0184", # git2 BlameHunk Signature UB — same; awaiting a git2 release.
28 + "RUSTSEC-2025-0141", # bincode unmaintained — transitive tooling, no code change available.
29 + "RUSTSEC-2020-0095", # difference unmaintained — via a dev/test dep.
30 + "RUSTSEC-2024-0436", # paste unmaintained — via proc-macro deps.
31 + "RUSTSEC-2025-0134", # rustls-pemfile unmaintained — via AWS SDK TLS.
32 + ]
33 +
34 + [bans]
35 + # Duplicate versions are the supply-chain smell the audits track (x509/crypto
36 + # cluster, rustls 0.21/0.23 dual stack via the AWS SDK). Surface them as
37 + # warnings rather than failing the build — they are transitive and not yet
38 + # de-duplicable — so a *new* duplicate is visible in CI output without blocking
39 + # a deploy. Promote to "deny" with a `skip` list once the tree is de-duped.
40 + multiple-versions = "warn"
41 + wildcards = "deny" # a `*` version requirement on any dependency fails the build
42 + allow-wildcard-paths = true # ...except first-party path deps, which legitimately use path, not version
43 + highlight = "all"
44 +
45 + [sources]
46 + unknown-registry = "deny" # no crate may come from a registry other than the allow-list below
47 + unknown-git = "deny" # no crate may come from an unsanctioned git remote
48 + allow-registry = ["https://github.com/rust-lang/crates.io-index"]
49 +
50 + [licenses]
51 + version = 2
52 + # Every license family present in the tree today. All permissive/weak-copyleft;
53 + # `r-efi`'s LGPL-2.1-or-later is satisfied by its MIT/Apache OR-clause.
54 + allow = [
55 + "MIT",
56 + "MIT-0",
57 + "Apache-2.0",
58 + "BSD-1-Clause",
59 + "BSD-2-Clause",
60 + "BSD-3-Clause",
61 + "0BSD",
62 + "ISC",
63 + "BSL-1.0",
64 + "Zlib",
65 + "MPL-2.0",
66 + "CC0-1.0",
67 + "Unlicense",
68 + "Unicode-3.0",
69 + "CDLA-Permissive-2.0",
70 + "BlueOak-1.0.0",
71 + "bzip2-1.0.6",
72 + ]
73 + confidence-threshold = 0.9
74 + # First-party product crates carry the product license; allow it for exactly
75 + # these, not tree-wide.
76 + exceptions = [
77 + { name = "makenotwork", allow = ["PolyForm-Noncommercial-1.0.0"] },
78 + { name = "tagtree", allow = ["PolyForm-Noncommercial-1.0.0"] },
79 + ]
M server/deploy/run-ci.sh +12
@@ -92,6 +92,18 @@ else
92 92 echo "[skip] cargo-audit not installed (cargo install cargo-audit)"
93 93 fi
94 94
95 + # Step 5b: Supply-chain gate (optional) — advisories + duplicate-version +
96 + # source policy via cargo-deny (config in deny.toml). Complements cargo audit:
97 + # `bans` surfaces duplicate-version clusters, `sources` fails on any dep from an
98 + # unsanctioned registry/git remote. Licenses are excluded from the gate until
99 + # the first-party path crates declare a license field (see deny.toml).
100 + if command -v cargo-deny &>/dev/null; then
101 + run_step "cargo deny" cargo deny check advisories bans sources
102 + else
103 + echo ""
104 + echo "[skip] cargo-deny not installed (cargo install cargo-deny --locked)"
105 + fi
106 +
95 107 # Post-cleanup
96 108 cleanup_test_dbs
97 109