Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
89 lines (85 loc) · 5.85 KB
/
Copy pathdeny.toml
File metadata and controls
89 lines (85 loc) · 5.85 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
[licenses]
allow = [
"Apache-2.0",
# "Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"BSL-1.0",
"CC0-1.0",
"GPL-3.0-only",
"ISC",
# "LGPL-3.0",
"MIT",
"MITNFA",
"MPL-2.0",
"OpenSSL",
"Unicode-3.0",
# "Unicode-DFS-2016",
# "Unlicense",
"Zlib",
]
[[licenses.clarify]]
name = "ring"
# ring is derived from BoringSSL and has a bit of a special licensing situation,
# but we can effectively treat is as OpenSSL-like licensing.
expression = "OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
[sources.allow-org]
github = [
"paradigmxyz",
# "alloy-rs",
"chainwayxyz",
"penumbra-zone",
]
[bans]
multiple-versions = "allow"
# We'd prefer to use Rustls instead of OpenSSL; this helps up from accidentally
# using OpenSSL. See <https://github.com/Sovereign-Labs/sovereign-sdk-wip/issues/352>.
deny = []
[advisories]
ignore = [
"RUSTSEC-2024-0388", # Unmaintained derivative crate
"RUSTSEC-2024-0384", # Unmaintained instant crate
"RUSTSEC-2024-0436", # Unmaintained paste crate
"RUSTSEC-2025-0012", # Unmaintained backoff crate
"RUSTSEC-2025-0055", # Ignore until risc0 update
"RUSTSEC-2023-0071", # Ignore rsa 0.9.8 until a version that fixes the issue is available.
"RUSTSEC-2025-0052", # Ignore unmaintained async-std
"RUSTSEC-2025-0073", # Ignore alloy-dyn-abi
"RUSTSEC-2025-0119", # Ignore unmaintained number-prefix
"RUSTSEC-2025-0134", # Ignore unmaintained rustls-pemfile
"RUSTSEC-2025-0141", # Ignore unmaintained bincode crate
"RUSTSEC-2026-0009", # Ignore as no user input time present in project
"RUSTSEC-2025-0137", # Ignore until it's fixed in upstream `alloy-primitives`. Though we shouldn't be affected.
# TODO: Remove after reth upgrade unblocks aws-lc-sys >=0.38.0 and rustls-webpki >=0.103.10
# None of these are reachable: Citrea doesn't use AES-CCM, PKCS7_verify, or CRL checking.
"RUSTSEC-2026-0045", # aws-lc-sys: AES-CCM timing side-channel (not used by rustls)
"RUSTSEC-2026-0046", # aws-lc-sys: PKCS7_verify cert chain bypass (not exposed via Rust API)
"RUSTSEC-2026-0047", # aws-lc-sys: PKCS7_verify signature bypass (not exposed via Rust API)
"RUSTSEC-2026-0048", # aws-lc-sys: CRL distribution point scope check (no CRL config in project)
"RUSTSEC-2026-0049", # rustls-webpki: CRL DP matching logic (no CRL config in project)
"RUSTSEC-2026-0098", # rustls-webpki: Name constraints for URI names were incorrectly accepted (we only use TLS as a client)
"RUSTSEC-2026-0099", # rustls-webpki: Name constraints were accepted for certificates asserting a wildcard name (we only use TLS as a client)
"RUSTSEC-2026-0104", # rustls-webpki: Reachable panic in certificate revocation list parsing (we only use TLS as a client)
# TODO: remove when boundless-market and alloy@1.0.9 is updated
"RUSTSEC-2026-0002", # lru: IterMut violates Stacked Borrows by invalidating internal pointer)
"RUSTSEC-2026-0105", # Ignore unmaintained core2
"RUSTSEC-2025-0161", # Ignore unmaintained libsecp256k1
"RUSTSEC-2026-0119", # Ignore p2p related message encoding vulnerability. Bounded by reth v1.3.7 → hickory-resolver ^0.25. Used only as stub resolver for peer discovery. Remove when reth tag is bumped.
"RUSTSEC-2026-0118", # Vulnerable code is behind the dnssec-ring/dnssec-aws-lc-rs feature, which is not enabled in our build. Bounded by reth v1.3.7 → hickory-resolver ^0.25. Remove when reth tag is bumped.
"RUSTSEC-2026-0173", # Ignore unmaintained proc-macro-error2
"RUSTSEC-2026-0183", # git2: Remote::list() unsoundness. Build-time only (vergen-git2 embedding git info). Fix requires git2 >=0.21, bounded by reth v1.3.7 → vergen-git2. Remove when reth tag is bumped.
"RUSTSEC-2026-0184", # git2: BlameHunk Signature unsoundness. Build-time only (vergen-git2 embedding git info). Fix requires git2 >=0.21, bounded by reth v1.3.7 → vergen-git2. Remove when reth tag is bumped.
"RUSTSEC-2026-0220", # ruint: wrong overflow flag on Uint shifts. Fix needs ruint >=1.20.0, which requires Rust 1.90 (we are on 1.88) and unpinning serde =1.0.218. We never call the affected APIs (checked/overflowing/saturating/strict shifts, to_base_be); revm guards SHL/SHR/SAR with `shift < 256` before using the plain operators.
"RUSTSEC-2026-0253", # lru: unsound LruCache::pop() on a panicking key Drop. Our own lru is on 0.18.4; the remaining copies are lru 0.12.5 (discv5 via reth v1.3.7, aws-sdk-s3) and lru 0.13.0 (alloy-provider 1.0.9 via boundless-market =1.0.1). Needs catch_unwind around a pop with a panicking key Drop, which none of them do. Remove when reth and boundless-market are bumped.
"RUSTSEC-2026-0258", # h2: unbounded empty DATA frames. No fix on the 0.3 line (patched >=0.4.16); our h2 0.4 is on 0.4.19. h2 0.3.26 is bounded by boundless-market =1.0.1 → aws-sdk-s3/httpmock, i.e. only against the operator-configured S3 endpoint and an in-process mock server. Remove when boundless-market is bumped.
# TODO: Remove these rustls ignores when the TLS dependency chain can be upgraded.
# rustls >=0.23.46 needs aws-lc-sys requiring cc >=1.2.26, blocked by reth v1.3.7's cc =1.2.15 pin;
# rustls 0.21 also requires migrating the legacy AWS HTTP client dependencies.
# Reassess if TLS providers, features, session stores, or endpoint policies change.
"RUSTSEC-2026-0346", # Session Debug secrets: no custom session store or logging of affected session values; built-in cache Debug output is redacted.
"RUSTSEC-2026-0348", # Certificate decompression DoS: rustls's non-default brotli feature is disabled, including with workspace --all-features.
"RUSTSEC-2026-0349", # Accept key-share prediction risk: current clients use/prefer classical groups; we do not rely on post-quantum TLS protection. No authentication bypass or key compromise.
"RUSTSEC-2026-0285", # Accept limited outbound TLS 1.3 handshake-metadata exposure: transcript authentication and application-data encryption remain intact.
]
unsound = "all"