1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# cargo-deny configuration (Phase 5 dependency hygiene).
# Run locally with: cargo deny check advisories licenses
# Rationale for every acknowledged advisory: docs/adr/0001-crypto-dependencies.md
[]
= true
[]
# Any advisory NOT listed here fails the check — new/unexpected advisories
# are denied by default.
= [
# rsa 0.9.x "Marvin" timing side-channel; no upstream fix available.
# Since the Ed25519/X25519 migration, NO normal operation performs RSA
# decryption: new identities are Ed25519, wraps are X25519 sealed boxes,
# and signatures are Ed25519. The vulnerable primitive (RSA private-key
# decryption) is reachable ONLY for legacy interop — unlocking a vault
# whose recipient entry predates `dl cert migrate`, and the single final
# unwrap performed by the migration itself. Local short-lived CLI, no
# remote timing oracle. See docs/adr/0001-crypto-dependencies.md.
{ = "RUSTSEC-2023-0071", = "no upstream fix; RSA decryption only reachable on the legacy-interop/migration path (`dl cert migrate`), never in normal ops; see ADR 0001" },
]
# Unmaintained TRANSITIVE crates (e.g. `fxhash` via `inquire`,
# RUSTSEC-2025-0057) are monitored, not fatal — we cannot fix them without
# forking the parent; a DIRECT unmaintained dependency still fails the check.
# Monitored in ADR 0001.
= "workspace"
# `spin 0.9.8` is a yanked transitive dependency (yanked != vulnerable; the
# lockfile still resolves it). Warn instead of deny until the parent crates
# move off it — monitored in ADR 0001; flip to "deny" afterwards.
= "warn"
[]
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Zlib",
# `colored` is MPL-2.0 (file-level copyleft only; used unmodified as a
# library dependency, which imposes no obligations on this binary).
"MPL-2.0",
]
[]
= "warn"
= "deny"
[]
= "deny"
= "deny"