L. C. Hsieh created SPARK-60370:
-----------------------------------
Summary: Run cargo audit in CI on a daily schedule and on
dependency changes
Key: SPARK-60370
URL: https://issues.apache.org/jira/browse/SPARK-60370
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
Nothing in CI checks dependencies against the RustSec advisory database.
Three advisories (h2, rustls, rsa) sat on main with CI green and were
found only by running `cargo audit` by hand. The h2 fix from SPARK-60115
is a --precise pin on a transitive dependency, so a later `cargo update`
or a hyper/tonic bump can silently undo it.
Add a workflow that runs `cargo audit`:
- daily on main (schedule), to catch newly published advisories;
- on pull requests that change Cargo.lock, Cargo.toml, crates/*/Cargo.toml,
.cargo/audit.toml, or the workflow itself, to stop a change from
introducing a vulnerable version.
It deliberately does not run on every PR. The advisory database changes
daily, so gating every PR on it would turn unrelated PRs red whenever a
new advisory is published. That is the same failure mode SPARK-59989 fixed
for the floating Rust toolchain. Newly published advisories surface on the
scheduled run; PRs are gated only on the dependency changes they make.
RUSTSEC-2023-0071 (rsa, no fixed release) is ignored in .cargo/audit.toml,
with a pointer to SPARK-XXXXX that tracks removing the ignore. cargo-audit
is installed with `cargo install --locked` rather than a third-party
action, to stay within the ASF GitHub Actions allowlist.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
