structured-proxy 8.1.4

# cargo-deny configuration.
# Run: cargo deny check advisories
#
# Only the advisories section is configured here; license/bans/sources checks
# fall back to cargo-deny defaults.

[advisories]
# RUSTSEC-2023-0071: "Marvin Attack" timing sidechannel in `rsa`.
# Chain: rsa -> sid-crypto (RustCrypto JWT and TLS providers) -> structured-proxy.
#
# Ignored deliberately. See https://github.com/structured-world/structured-proxy/issues/48
#   1. No fix exists: the advisory has patched:[] / unaffected:[] in the RustSec
#      DB. There is nothing to upgrade to, release candidates included.
#   2. We keep pure-Rust crypto over C, required by no-C consumers (e.g.
#      CoordiNode ADR-013).
#   3. RSA here only ever verifies signatures with public keys: JWTs, and the
#      certificates and handshake signatures of the TLS servers the proxy calls.
#      Both providers refuse RSA private keys, and Marvin targets private-key
#      timing (decrypt/sign), which cannot run on this path.
#      Revisit when RustCrypto ships a constant-time `rsa` stable release.
#
# The chain comes with the `rust_crypto` feature: a `default-features = false`
# build does not link it, and CI checks that the crate ignored here is not in it.
ignore = [
  { id = "RUSTSEC-2023-0071", reason = "No fixed `rsa` release exists: the advisory is patched:[]. We deliberately keep pure-Rust crypto over C. The RustCrypto providers of sid-crypto refuse RSA private keys and RSA only verifies signatures with public keys; Marvin targets private-key timing, not exploitable on a verify path. Revisit when RustCrypto ships a constant-time `rsa` stable. Tracking: structured-world/structured-proxy#48" },
]