# cargo-deny configuration.
# Run: cargo deny check advisories
#
# Only the advisories section is configured here; license/bans/sources checks
# fall back to cargo-deny defaults.
[advisories]
# RUSTSEC-2023-0071 — "Marvin Attack" timing sidechannel in `rsa` 0.9.x.
# Chain: rsa -> jsonwebtoken (rust_crypto backend) -> structured-proxy.
#
# Ignored deliberately. See https://github.com/structured-world/structured-proxy/issues/48
# 1. No fix exists: the advisory has patched:[] / unaffected:[] in the RustSec
# DB, and it names both the latest stable `rsa` (0.9.10) and the latest
# pre-release (0.10.0-rc.18) as affected. There is nothing to upgrade to,
# release candidates included.
# 2. We keep jsonwebtoken's pure-Rust `rust_crypto` backend over `aws_lc_rs`
# (C FFI), required by no-FFI consumers (e.g. CoordiNode ADR-013).
# 3. RSA here is used for JWT *verification* (public key) only. Marvin targets
# private-key timing (decrypt/sign), which never runs on the verify path.
# Revisit when RustCrypto ships a constant-time `rsa` stable release.
#
# The ignore covers the DEFAULT build only. `rsa` arrives with jsonwebtoken's
# whole `rust_crypto` bundle (it has no per-algorithm features), so it cannot be
# dropped by a feature of ours while that backend is in use. A deployment that
# will not carry the advisory at all builds with `default-features = false` and
# injects its own `hooks::TokenVerifier`: no jsonwebtoken, no `rsa`, nothing to
# ignore. The `injected_verifier` CI leg builds exactly that.
ignore = [
{ id = "RUSTSEC-2023-0071", reason = "No fixed `rsa` release exists: the advisory is patched:[] and names both the latest stable (0.9.10) and the latest pre-release (0.10.0-rc.18) as affected. We deliberately keep jsonwebtoken's pure-Rust `rust_crypto` backend over `aws_lc_rs` (C FFI). RSA is used for JWT verification (public key) only; Marvin targets private-key timing, not exploitable on the verify path. A build that must not link `rsa` at all takes default-features = false and injects its own TokenVerifier. Revisit when RustCrypto ships a constant-time `rsa` stable. Tracking: structured-world/structured-proxy#48" },
]