# Dependency advisory policy for {{project_name}} — generated by autumn {{autumn_version}}.
#
# `.github/workflows/ci.yml` runs `cargo deny check` against this file on every
# push and pull request. If any crate in this app's dependency tree — direct or
# transitive — carries a known RustSec security advisory that is not waived
# below, the job fails and the change does not merge.
#
# Full guide: docs/guide/supply-chain.md in the Autumn repository
# (https://github.com/autumn-foundation/autumn/blob/trunk/docs/guide/supply-chain.md).
#
# ── Reading a failure ───────────────────────────────────────────────────────
# For every finding cargo-deny prints the advisory id (`RUSTSEC-YYYY-NNNN`), a
# one-line title, the affected crate and version, the fixed version if one
# exists, and the dependency path that pulled the crate into your tree — read
# that path bottom-up to find which of your dependencies to bump. Reproduce the
# CI failure locally with:
#
# cargo install --locked cargo-deny # once
# cargo deny check advisories
#
# ── Fixing one ──────────────────────────────────────────────────────────────
# Prefer a fix over a waiver:
# 1. `cargo update -p <crate>` when a patched version is already compatible.
# 2. Otherwise bump the direct dependency that pulls the vulnerable crate in.
# 3. When that dependency is `autumn-web` — the common case, since most of
# this tree arrives through it — upgrade to an autumn-web release that
# resolves a fixed version. If none does yet, open an issue at
# https://github.com/autumn-foundation/autumn/issues and waive it here
# with a review-by date in the meantime.
#
# ── Waiving one ─────────────────────────────────────────────────────────────
# When no fix exists (the advisory says "no safe upgrade is available") or the
# vulnerable code path is unreachable from this app, add an entry to `ignore`
# below with the advisory id, a `reason` recording why the exposure is
# acceptable here, and a review-by date. This is the *only* supported way to
# accept an advisory: the gate itself stays on, and a waiver lets exactly one
# id through — every other advisory, including a new one in the same crate,
# still fails CI. Waivers are debt; revisit them on their review-by date.
#
# ── The dev loop ────────────────────────────────────────────────────────────
# `autumn doctor` evaluates this file too — same policy, same waivers, same
# checks as CI — so a local verdict predicts the CI verdict. Two differences
# remain and doctor reports both: CI pins cargo-deny 0.20.2 while a local run
# uses whatever is installed, and CI fetches the advisory database on every run
# while doctor reads local data and names its age.
#
# `autumn dev` stays quiet: it reports only findings this policy DENIES, which
# are the ones that turn CI red. A clean tree prints nothing. See
# docs/guide/supply-chain.md.
#
# ── Optional sections ───────────────────────────────────────────────────────
# The `[licenses]`, `[bans]` and `[sources]` sections below ship commented out,
# so a fresh app enforces advisories only. Uncomment one and both `autumn
# doctor` and `.github/workflows/ci.yml` start to enforce it: the workflow
# derives its check list from the sections this file declares. Nothing else to
# wire.
[advisories]
# Cover the whole resolved dependency graph, transitive crates included.
#
# Vulnerabilities are always denied — that is not configurable, and it is the
# part of this gate that matters most. `unmaintained` and `unsound` are stated
# explicitly rather than left to cargo-deny's version-dependent default, so this
# policy means the same thing on every auditor version.
#
# If unmaintained/unsound findings deep in the tree are more noise than signal
# for this app — they are not vulnerabilities, and you often cannot fix a crate
# five levels down — set either to "none". Vulnerabilities keep failing
# regardless. ("workspace" scopes a check to your own crates, which for a
# single-crate app means the same thing as "none"; the useful values here are
# "all" and "none".) Yanked crates warn rather than fail: a yank is not a
# vulnerability.
unmaintained = "all"
unsound = "all"
yanked = "warn"
ignore = [
# RUSTSEC-2023-0071 — `rsa` "Marvin Attack" timing sidechannel.
# https://rustsec.org/advisories/RUSTSEC-2023-0071
#
# Ships pre-waived because it is unavoidable rather than accepted lightly:
# `rsa` reaches an Autumn app through `jsonwebtoken`, which autumn-web
# compiles behind its default-on `jwt` feature (and a passkey app through
# `webauthn-rs`, for public-key checks only), and no patched `rsa` release
# exists (the advisory says "no safe upgrade is available"). An app that
# turns off default features and leaves out `jwt` and `oauth2` (and
# `webauthn`) does not compile `rsa`, and can delete this waiver. The vulnerable path is RSA-family
# JWT signing/verification; key recovery needs an attacker-timed RSA
# private-key operation oracle, which an Autumn app does not expose by
# default. Autumn re-triages this every release and drops the waiver when a
# fixed `rsa` — or a `jsonwebtoken` without the RSA backend — ships, so the
# review-by below is Autumn's cadence: on a date that has passed, take the
# newest autumn-web and re-run the audit before assuming it still stands.
# Review-by: 2026-11-02 (reconfirmed unchanged 2026-10-05: still no fixed
# rsa release; see docs/reports/2026-10-05-ballast-dependency-ledger-audit.md).
{ id = "RUSTSEC-2023-0071", reason = "no fixed rsa release exists; reaches this app only through jsonwebtoken's RSA-family JWT path (autumn-web `jwt` feature, default-on); reconfirmed unchanged 2026-10-05; review-by 2026-11-02" },
# RUSTSEC-2026-0387 — `crypto-bigint` has secret-dependent branches in
# nominally constant-time operations.
# https://rustsec.org/advisories/RUSTSEC-2026-0387
#
# Ships pre-waived because the fix is only in crypto-bigint >=0.7.6 and the
# RustCrypto elliptic-curve stack that autumn-web's `jsonwebtoken`
# (ES256/ES384) uses is still on 0.5.x. A microarchitectural timing leak on
# ECDSA secrets; no network-reachable signing oracle. Drop this waiver when
# `jsonwebtoken` moves to p256 0.14 (crypto-bigint 0.7), or when this app
# leaves out autumn-web's `jwt` feature (and `oauth2`, which turns it on).
# Review-by: 2026-11-08.
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.x via jsonwebtoken ES256/ES384 (autumn-web `jwt` feature, default-on) -> p256/p384 -> elliptic-curve 0.13; fix needs crypto-bigint >=0.7.6; review-by 2026-11-08" },
]
# ── Licenses (optional) ─────────────────────────────────────────────────────
# Enforce a license allow-list over the whole dependency graph. List every
# license your tree actually uses — `cargo deny list` prints them — and expect
# to add one when a transitive dependency changes. The list below is a starting
# point, not a complete answer: run `cargo deny check licenses` once after
# uncommenting and add what it names.
#
# `private.ignore` only skips crates marked `publish = false`. Add that key to
# this app's own `Cargo.toml`, or give it a `license` field; without either it
# is graded unlicensed.
#
# [licenses]
# allow = ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Zlib", "CDLA-Permissive-2.0", "PostgreSQL", "MPL-2.0", "OpenSSL"]
# private = { ignore = true }
# ── Banned crates (optional) ────────────────────────────────────────────────
# Refuse named crates anywhere in the graph. `multiple-versions = "allow"` is
# deliberate: a real tree carries dozens of duplicate crates you cannot fix,
# and a warning for each one buries the bans you did write.
#
# [bans]
# multiple-versions = "allow"
# deny = [
# # { crate = "openssl", reason = "this app uses rustls" },
# ]
# ── Sources (optional) ──────────────────────────────────────────────────────
# Restrict where crates may come from. The values below allow crates.io only;
# add each vendored git dependency to `allow-git` by URL.
#
# [sources]
# unknown-registry = "deny"
# unknown-git = "deny"
# allow-git = []