1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
# Supply-chain policy.
#
# Every exception below is an *accepted* risk with a stated reason and a revisit
# condition, not a silenced warning. An unexplained ignore is worse than no gate
# at all: it looks like the check passed.
[]
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"CDLA-Permissive-2.0",
"Zlib",
# MPL-2.0 is deliberately *not* allowed. Nothing in the graph needs it, and
# its file-level copyleft is a question a utility's procurement review should
# be asked before the answer is already in the lockfile.
# libbz2-rs-sys, reached through datafusion -> async-compression -> bzip2.
# The original bzip2 licence: BSD-style, permissive, no copyleft, compatible
# with this crate's MIT OR Apache-2.0 dual licensing.
"bzip2-1.0.6",
# tiny-keccak, reached through iceberg-storage-opendal -> reqsign-aws-v4.
# A public-domain dedication — the most permissive terms there are.
"CC0-1.0",
]
[]
= "deny"
= [
# `paste` is unmaintained. Not a vulnerability — the crate works, nobody is
# updating it. Reached through `datafusion-common`, so there is nothing to
# do here beyond waiting for DataFusion to drop it.
# Revisit: when DataFusion removes the dependency.
"RUSTSEC-2024-0436",
# `quick-xml` quadratic attribute checking, and unbounded namespace
# allocation. Both are denial of service against a parser fed **untrusted**
# XML. Reached through `opendal-core` and `reqsign-aws-v4`, which parse
# responses from the configured object store and its IAM endpoint — trusted
# infrastructure, not attacker-supplied input. No patched version exists
# within the range opendal pins, so this cannot be resolved by updating.
# Revisit: when opendal releases against a patched quick-xml.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
# `rsa` timing sidechannel (Marvin Attack). **No patched version exists** —
# upstream has no constant-time implementation yet — so this cannot be
# resolved by updating, and the crate cannot be swapped out from here.
#
# Reached only through the opt-in cloud object stores, and only two of them:
# object-store-gcs -> reqsign-google -> rsa
# object-store-azure -> reqsign-azure-storage -> rsa
# `object-store-s3` and the default build do not contain it. The `[bans]`
# entry below pins that: `rsa` may enter only through those two crates, so a
# dependency update introducing it anywhere else fails rather than silently
# widening what this exception covers.
#
# In both, the single use is signing a JWT assertion to obtain an OAuth
# token — a GCP service-account key, an Azure AD client certificate. It is
# therefore unreachable unless the deployment authenticates with such a key:
# workload identity, managed identity, instance metadata and (on S3-family
# stores) HMAC signing perform no RSA private-key operation. `WarehouseAuth`
# carries no GCP or Azure credentials, so meterstore never supplies such a
# key itself; it would come from the ambient environment through opendal's
# credential chain. The signature is made at token acquisition, cached for
# the token's lifetime, and sent outbound to the provider — not on the data
# path, and not driven by anything an attacker submits.
#
# Revisit: when RustCrypto/RSA ships the constant-time implementation
# (RustCrypto/RSA#626), or when reqsign stops depending on it. A deployment
# that cannot accept this should build without `object-store-gcs` and
# `object-store-azure` and pass a pre-built `Arc<dyn Catalog>` to
# `IcebergCold::new` instead.
"RUSTSEC-2023-0071",
# `rustls-pemfile` is unmaintained, and `tokio-tar` mis-parses PAX extended
# headers. Both arrive **only** through `testcontainers`, a dev-dependency:
# neither is compiled into the library, and the tar files involved are
# container images this repository's own tests pull. `tokio-tar` is archived
# with no safe upgrade available.
# Revisit: when testcontainers moves off bollard's TLS stack and off
# tokio-tar, or when a maintained fork is adopted upstream.
"RUSTSEC-2025-0134",
"RUSTSEC-2025-0111",
]
[]
= "warn"
# Single-sourced: see .github/workflows/ci.yml. A second `datafusion` major
# gives mutually incompatible `TableProvider` types, which does not fail
# obviously — a crate simply cannot be used with the other's types.
= [
{ = "datafusion-table-providers" },
# The accepted RUSTSEC-2023-0071 exception above rests on *where* `rsa`
# enters the graph: two credential signers, used only for OAuth token
# acquisition. Pinning the wrappers keeps that true — if an update pulls
# `rsa` in anywhere else, the exposure the exception describes no longer
# matches the graph, and this fails instead of the comment quietly going
# stale.
{ = "rsa", = ["reqsign-google", "reqsign-azure-storage", "reqsign-core"] },
]