1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# Supply-chain policy.
#
# Every exception below is an *accepted* risk with a stated reason and a revisit
# condition, not a silenced warning. An unexplained ignore is worse than no gate
# at all: it looks like the check passed.
[]
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"CDLA-Permissive-2.0",
"Zlib",
# MPL-2.0 is deliberately *not* allowed. Nothing in the graph needs it, and
# its file-level copyleft is a question a utility's procurement review should
# be asked before the answer is already in the lockfile.
# libbz2-rs-sys, reached through datafusion -> async-compression -> bzip2.
# The original bzip2 licence: BSD-style, permissive, no copyleft, compatible
# with this crate's MIT OR Apache-2.0 dual licensing.
"bzip2-1.0.6",
# tiny-keccak, reached through iceberg-storage-opendal -> reqsign-aws-v4.
# A public-domain dedication — the most permissive terms there are.
"CC0-1.0",
]
[]
= "deny"
= [
# `paste` is unmaintained. Not a vulnerability — the crate works, nobody is
# updating it. Reached through `datafusion-common`, so there is nothing to
# do here beyond waiting for DataFusion to drop it.
# Revisit: when DataFusion removes the dependency.
"RUSTSEC-2024-0436",
# `quick-xml` quadratic attribute checking, and unbounded namespace
# allocation. Both are denial of service against a parser fed **untrusted**
# XML. Reached through `opendal-core` and `reqsign-aws-v4`, which parse
# responses from the configured object store and its IAM endpoint — trusted
# infrastructure, not attacker-supplied input. No patched version exists
# within the range opendal pins, so this cannot be resolved by updating.
# Revisit: when opendal releases against a patched quick-xml.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
# `rsa` 0.9 leaks private-key information through timing (the Marvin Attack).
# **There is no patched version** — upstream says "no safe upgrade is
# available" and the constant-time rewrite is unfinished — so this cannot be
# resolved by updating, only by accepting or by dropping the features that
# reach it.
#
# It enters only under the opt-in `object-store-gcs` / `object-store-azure`
# features, through `reqsign-{core,google,azure-storage}`, and its single use
# there is **signing** — a JWT assertion exchanged for an OAuth token, and
# GCS signed URLs — with `RandomizedSigner`, i.e. blinded PKCS#1 v1.5.
#
# The attack needs an oracle whose timing the attacker can observe over the
# network while influencing the input. Here the client holds the key and does
# the signing locally, at token-refresh cadence, over input it chose itself;
# there is no remote party timing our operation. That is the "local use on a
# non-compromised computer" case the advisory names as acceptable.
#
# This went unrecorded until the audit ran with `--all-features`: the gate had
# been reading a graph that contained no `rsa` at all.
# Revisit: when `rsa` 0.10 ships a constant-time implementation, or when
# opendal's signers move off it.
"RUSTSEC-2023-0071",
]
[]
= "warn"
# Single-sourced: see .github/workflows/ci.yml. A second `datafusion` major
# gives mutually incompatible `TableProvider` types, which does not fail
# obviously — a crate simply cannot be used with the other's types.
= [
{ = "datafusion-table-providers" },
# `rsa` carries an unpatched timing sidechannel (see the advisory ignore
# above). It enters only under the opt-in GCS/Azure features, through three
# credential signers, where its use is signing a JWT assertion to obtain an
# OAuth token — outbound, cached for the token's lifetime, off the data path.
#
# Pinning the wrappers keeps that true: an update that pulled `rsa` in
# somewhere else would put a private-key operation somewhere nobody has
# reasoned about, and this fails rather than letting it pass. `reqsign-google`
# was missing from this list and nothing noticed, because the audit ran
# without the features that reach it.
{ = "rsa", = [
"reqsign-azure-storage",
"reqsign-core",
"reqsign-google",
] },
]