dev-security 0.9.0

Security auditing for Rust. Wraps cargo-audit and cargo-deny. Vulnerability scanning, license compliance, banned-crate policies. Part of the dev-* verification suite.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

# dev-security — API Reference

> Hand-written reference.

## Table of contents

- [`AuditScope`](#auditscope)
- [`AuditRun`](#auditrun)
  - [`AuditRun::new`](#auditrunnew)
  - [`AuditRun::scope`](#auditrunscope)
  - [`AuditRun::execute`](#auditrunexecute)
- [`Finding`](#finding)
- [`AuditResult`](#auditresult)
  - [Fields](#auditresult-fields)
  - [`AuditResult::count_at_or_above`](#auditresultcount_at_or_above)
  - [`AuditResult::into_report`](#auditresultinto_report)
- [`AuditError`](#auditerror)

---

## `AuditScope`

```rust
pub enum AuditScope {
    Vulnerabilities,    // cargo-audit only
    Policy,             // cargo-deny only
    All,                // both
}
```

---

## `AuditRun`

```rust
pub struct AuditRun { /* private */ }
```

### `AuditRun::new`

```rust
pub fn new(name: impl Into<String>, version: impl Into<String>) -> Self
```

| Parameter | Type                | Description    |
|-----------|---------------------|----------------|
| `name`    | `impl Into<String>` | Crate name.    |
| `version` | `impl Into<String>` | Crate version. |

### `AuditRun::scope`

```rust
pub fn scope(self, scope: AuditScope) -> Self
```

### `AuditRun::execute`

```rust
pub fn execute(&self) -> Result<AuditResult, AuditError>
```

Run the configured audit.

---

## `Finding`

```rust
pub struct Finding {
    pub id: String,             // RUSTSEC-* or policy rule name
    pub title: String,
    pub severity: Severity,     // from dev-report
    pub affected_crate: String,
}
```

---

## `AuditResult`

```rust
pub struct AuditResult {
    pub name: String,
    pub version: String,
    pub scope: AuditScope,
    pub findings: Vec<Finding>,
}
```

### AuditResult fields

| Field      | Type             | Description                         |
|------------|------------------|-------------------------------------|
| `name`     | `String`         | Crate name.                         |
| `version`  | `String`         | Crate version.                      |
| `scope`    | `AuditScope`     | Scope that produced this result.    |
| `findings` | `Vec<Finding>`   | Discovered findings.                |

### `AuditResult::count_at_or_above`

```rust
pub fn count_at_or_above(&self, threshold: Severity) -> usize
```

Count findings at or above the given severity. Useful for gating
CI on "Critical or Error count > 0" without inspecting individual
findings.

### `AuditResult::into_report`

```rust
pub fn into_report(self) -> Report
```

Convert findings into a `dev-report::Report`. Empty findings produces
a passing `security::audit` check.

---

## `AuditError`

```rust
pub enum AuditError {
    AuditToolNotInstalled,
    DenyToolNotInstalled,
    SubprocessFailed(String),
    ParseError(String),
}
```

Tool remediation: `cargo install cargo-audit cargo-deny`.