max / makenotwork

Ban the C crypto backends by name in cargo-deny Two comments in server/Cargo.toml (on webauthn-rs and on async-stripe) said cargo-deny banned openssl-sys. It did not: [bans] carried multiple-versions and wildcards but no deny list at all, so the claim had never been enforced. That gap is what let the server sit on aws-lc-rs while 257e768e moved the rest of the tree to ring, with a green sweep the whole time. 3932f894 fixed the state; this makes the checker able to see it, so it cannot drift back. Names the `-sys` crates rather than the wrappers: the wrapper is reachable as a no-op feature, and the C toolchain on every native build path is the actual cost.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-08-08 18:05 UTC

Signed with PGP, not checked

Commit: 80cfdc13a474e438ca68c233a9affbef924c1641

Parent: 3932f89

1 file changed, +17 insertions, -0 deletions

M server/deny.toml +17

			@@ -41,6 +41,23 @@
41	41		allow-wildcard-paths = true # ...except first-party path deps, which legitimately use path, not version
42	42		highlight = "all"
43	43
	44	+	# The C crypto backends, banned by name. Two comments in Cargo.toml (on
	45	+	# webauthn-rs and on async-stripe) already said cargo-deny banned openssl-sys;
	46	+	# until now it did not, and nothing here could see the server sitting on
	47	+	# aws-lc-rs while the rest of the tree moved to ring. These are the `-sys`
	48	+	# crates rather than their wrappers because the wrapper is reachable as a
	49	+	# no-op feature, and it is the C toolchain that is the cost: it lands on the
	50	+	# build path for every architecture built natively (fw13, astra, mbp,
	51	+	# windows-x86) and it is what stops miri from ever reaching a verdict.
	52	+	#
	53	+	# The standing choice is the most-Rust backend available: rust_crypto > ring >
	54	+	# aws-lc-rs. If a transitive dep drags one of these back in, that is a real
	55	+	# finding and the fix is a feature selection, not an entry in this list.
	56	+	deny = [
	57	+	{ name = "openssl-sys" },
	58	+	{ name = "aws-lc-sys" },
	59	+	]
	60	+
44	61		[sources]
45	62		unknown-registry = "deny" # no crate may come from a registry other than the allow-list below
46	63		unknown-git = "deny" # no crate may come from an unsanctioned git remote