[
https://issues.apache.org/jira/browse/SPARK-60370?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
L. C. Hsieh resolved SPARK-60370.
---------------------------------
Fix Version/s: connect-gateway-0.1.0
Resolution: Fixed
Issue resolved by pull request 52
[https://github.com/apache/spark-connect-gateway/pull/52]
> Run cargo audit in CI on a daily schedule and on dependency changes
> -------------------------------------------------------------------
>
> Key: SPARK-60370
> URL: https://issues.apache.org/jira/browse/SPARK-60370
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
> Labels: pull-request-available
> Fix For: connect-gateway-0.1.0
>
>
> Nothing in CI checks dependencies against the RustSec advisory database.
> Three advisories (h2, rustls, rsa) sat on main with CI green and were
> found only by running `cargo audit` by hand. The h2 fix from SPARK-60115
> is a --precise pin on a transitive dependency, so a later `cargo update`
> or a hyper/tonic bump can silently undo it.
> Add a workflow that runs `cargo audit`:
> - daily on main (schedule), to catch newly published advisories;
> - on pull requests that change Cargo.lock, Cargo.toml, crates/*/Cargo.toml,
> .cargo/audit.toml, or the workflow itself, to stop a change from
> introducing a vulnerable version.
> It deliberately does not run on every PR. The advisory database changes
> daily, so gating every PR on it would turn unrelated PRs red whenever a
> new advisory is published. That is the same failure mode SPARK-59989 fixed
> for the floating Rust toolchain. Newly published advisories surface on the
> scheduled run; PRs are gated only on the dependency changes they make.
> RUSTSEC-2023-0071 (rsa, no fixed release) is ignored in .cargo/audit.toml,
> with a pointer to SPARK-60370 that tracks removing the ignore. cargo-audit
> is installed with `cargo install --locked` rather than a third-party
> action, to stay within the ASF GitHub Actions allowlist.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
