Andy Dixon
b325097602
- ci.yml declares permissions: contents: read instead of the default token scope. - Every action is pinned to the commit its current tag points at (checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2), so a moved tag can't change what runs with release write access. - A cargo audit job runs on every push; the single ignored advisory (RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012). Release signing and macOS notarisation are not part of this change.
10 lines
453 B
TOML
10 lines
453 B
TOML
# cargo audit configuration (CI runs `cargo audit` from rust/).
|
|
[advisories]
|
|
ignore = [
|
|
# 2026-10-12: rsa Marvin timing side channel, pulled in by russh's `rsa` feature. No fixed
|
|
# release exists. The client signs once per user-initiated connection, so collecting enough
|
|
# timings is impractical; Ed25519 is the default for generated keys. Re-check when rsa ships a
|
|
# constant-time release (SEC-20261012-012).
|
|
"RUSTSEC-2023-0071",
|
|
]
|