enricobuehler
705a8fa94e
axum-server was used only for the plain-HTTP nvhttp listener, but we enabled its tls-rustls feature (HTTPS is hand-rolled over tokio-rustls) — and that feature was what pulled the unmaintained rustls-pemfile (RUSTSEC-2025-0134). Drop the feature, bump axum-server to 0.8 (0.8 also no longer pulls it), and move our own PEM parsing in gamestream/tls.rs to rustls-pki-types' PemObject (the same path punktfunk-core/quic.rs already uses), removing our direct rustls-pemfile dep too. Net: rustls-pemfile fully gone; dependency graph trimmed 547 -> 529 crates (the tls-rustls feature also dragged in prettyplease + a wasm-tooling chain). cargo audit now reports only audiopus_sys + paste (transitive, latest, no successor). 108 host tests + clippy + fmt green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
1.5 KiB
TOML
24 lines
1.5 KiB
TOML
# cargo-audit configuration — consumed by `.gitea/workflows/audit.yml` (`cargo audit`).
|
|
#
|
|
# Silence only advisories that are KNOWN-UNFIXABLE and either not applicable to how we use the crate
|
|
# or an accepted, documented risk. Keep this list TIGHT and justify every entry — an ignore here
|
|
# means the audit job stops flagging it, so the reasoning must hold up.
|
|
#
|
|
# NOTE: `cargo audit` (no `--deny warnings`) fails only on *vulnerabilities*, not on the
|
|
# `unmaintained` warnings (audiopus_sys via opus, paste via utoipa-axum). Both are transitive, at
|
|
# their latest published version with no successor, so there's nothing to bump — left visible on
|
|
# purpose so we keep getting the maintenance signal; they do not fail CI. (rustls-pemfile was dropped
|
|
# 2026-06-29 by removing axum-server's unused tls-rustls feature + moving our own PEM parsing to
|
|
# rustls-pki-types; memmap2's unsoundness was fixed by the 0.9.11 bump.)
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# rsa "Marvin Attack" — a timing sidechannel in RSA *decryption* (PKCS#1 v1.5 padding oracle).
|
|
# There is NO fixed rsa release (the constant-time rewrite is still unreleased upstream), and rsa
|
|
# is required for GameStream/Moonlight pairing. Crucially, the host uses rsa ONLY for PKCS#1 v1.5
|
|
# SIGNING / VERIFYING (gamestream/cert.rs + gamestream/pairing.rs: SigningKey / VerifyingKey /
|
|
# Signer / Verifier) — it never performs RSA decryption, which is the operation Marvin targets.
|
|
# So the vulnerable code path is not exercised. Revisit if a fixed rsa ships or we add RSA decrypt.
|
|
"RUSTSEC-2023-0071",
|
|
]
|