chore(supply-chain): cargo-vet exemptions for the breaking and crypto batches

Merged
BN
10d ago
+13-5

Policy-only PR for the two dependency batches: #571 (crypto) and #572 (breaking). Merge this first; both need it to pass cargo vet --locked.

What changes

  • supply-chain/config.toml only: 97 new safe-to-deploy exemptions. The diff is 388 added lines and 0 removed.
  • The 97 cover the crate versions that #571 and #572 introduce, plus the 43 versions public/main is already missing. cargo vet --locked fails on main today with those 43 (after #570).

Why this shape

AGENTS.md "Supply-chain policy isolation": a PR that touches supply-chain/ may share a PR only with Cargo.lock and manifests in the sanctioned dependency shape. This PR changes nothing else, so it is a dedicated policy PR under .github/workflows/supply-chain.yml. The guard file is not touched.

Verification (store formatted with cargo vet fmt)

  • cargo vet --locked on public/main + this PR: pass. "Vetting Succeeded (18 fully audited, 5 partially audited, 465 exempted)".
  • cargo vet --locked on #571 head + this PR: pass. (17 / 2 / 472)
  • cargo vet --locked on #572 head + this PR: pass. (18 / 5 / 461)

Review notes

  • An exemption is a trust decision, not an audit: it records that a reviewer accepts that crate version without an entry in audits.toml. Same convention as the rest of this file.
  • Please confirm the list below before merge.
  • Follow-up after #571 and #572 land: exemptions for versions they remove become unused. Prune them then. Not done here, because public/main still uses those versions.

Exempted crates (97)

asn1-rs:0.7.2
asn1-rs-derive:0.6.0
async-trait:0.1.92
axum:0.8.9
axum-core:0.5.6
axum-server:0.8.0
base64:0.23.1
bit-set:0.11.1
bit-vec:0.10.1
bit-vec:0.9.1
borsh:1.8.1
borsh-derive:1.8.1
bytes:1.12.1
cap-primitives:4.0.3
cap-std:4.0.3
clap:4.6.7
clap_builder:4.6.7
clap_derive:4.6.7
core_detect:1.0.0
cron:0.17.0
der-parser:10.0.0
flate2:1.1.10
foldhash:0.2.0
futures:0.3.34
futures-channel:0.3.34
futures-core:0.3.34
futures-executor:0.3.34
futures-io:0.3.34
futures-macro:0.3.34
futures-sink:0.3.34
futures-task:0.3.34
futures-util:0.3.34
glob:0.3.4
globset:0.4.20
hashlink:0.12.2
hyper:1.12.0
hyper-util:0.1.21
indexmap:2.14.2
io-extras:0.19.0
io-lifetimes:3.0.1
libc:0.2.190
libsqlite3-sys:0.38.2
matchit:0.8.4
miniz_oxide:0.9.1
nix:0.31.3
oid-registry:0.8.1
opentelemetry:0.33.1
opentelemetry-appender-tracing:0.33.1
opentelemetry-http:0.33.1
opentelemetry-otlp:0.33.1
opentelemetry-proto:0.33.1
opentelemetry_sdk:0.33.1
opentelemetry-semantic-conventions:0.33.1
pem:4.0.0
phf:0.11.3
phf_generator:0.11.3
phf_macros:0.11.3
phf_shared:0.11.3
proptest:1.12.0
rand_xorshift:0.5.0
rcgen:0.14.10
regex:1.13.1
regex-automata:0.4.18
reqwest:0.13.5
rsqlite-vfs:0.1.1
rusqlite:0.40.2
serde:1.0.229
serde_core:1.0.229
serde_derive:1.0.229
serde_json:1.0.154
serde_spanned:1.1.2
sha1:0.11.0
similar:3.2.0
sqlite-wasm-rs:0.5.5
tokio:1.53.2
tokio-tungstenite:0.29.0
tokio-tungstenite:0.30.0
tokio-util:0.7.20
toml:1.1.8+spec-1.1.0
toml_datetime:1.1.2+spec-1.1.0
toml_parser:1.1.5+spec-1.1.0
toml_writer:1.1.3+spec-1.1.0
tower-http:0.7.1
tracing-opentelemetry:0.34.0
tree-sitter:0.27.1
tree-sitter-language:0.1.9
tungstenite:0.29.0
tungstenite:0.30.0
typed-path:0.12.3
utoipa:6.0.0
utoipa-gen:6.0.1
uuid:1.28.0
want:0.3.2
x509-parser:0.18.1
yasna:0.6.0
zip:8.6.0
zlib-rs:0.6.8

Devin Review

Summary by cubic

Updates supply-chain/config.toml after rebasing onto the merged crypto exemptions, so the diff is now much smaller than the original batch.

  • Upgrades 5 exemptions (bit-set, bit-vec, borsh, borsh-derive, core_detect) from safe-to-run to safe-to-deploy, since #571 and #572 now require the stronger criterion.
  • Adds safe-to-deploy entries for proptest and rand_xorshift, which previously only had safe-to-run exemptions.
  • Policy-only change: the diff touches nothing outside supply-chain/.

Summary by CodeRabbit

  • Chores
    • Updated deployment safety classifications for several software components. Existing run-safety classifications remain in place for two components, alongside their new deployment classifications. These updates change how the components are assessed for deployment; they do not add or remove product functionality.