From 7af0f1e47eb6fc4ac59d4d67f70c1bca540e4276 Mon Sep 17 00:00:00 2001 From: Ilan Harel Date: Mon, 9 Nov 2026 13:30:26 +0200 Subject: [PATCH] chore(audit): ignore RUSTSEC-2026-0459 until OpenShell bumps libsqlite3-sys libsqlite3-sys 0.37.0 comes in through OpenShell v0.1.7 openshell-crypto -> sqlx 0.9.0, which pins sqlx-sqlite exactly, so it cannot be upgraded from this repository. Ignore exactly that advisory in .cargo/audit.toml with a link and removal condition, and document the check in DEVELOPING.md. Closes #76 Signed-off-by: Ilan Harel --- .cargo/audit.toml | 12 ++++++++++++ CHANGELOG.md | 1 + docs/DEVELOPING.md | 4 ++++ 3 files changed, 17 insertions(+) create mode 100644 .cargo/audit.toml diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 0000000..7a5579a --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,12 @@ +# cargo-audit configuration (read by `cargo audit`, which the `audit` job in .github/workflows/ci.yml runs). +# Every ignore must name one advisory, say why it cannot be fixed here, and when to remove it. + +[advisories] +ignore = [ + # RUSTSEC-2026-0459: libsqlite3-sys 0.37.0 (C SQLite CVE-2026-119375), fixed in >= 0.39.0. + # https://rustsec.org/advisories/RUSTSEC-2026-0459 - tracked in https://github.com/ilanh/openshell-annotate/issues/76 + # Transitive and not upgradable from this repo: OpenShell v0.1.7 openshell-crypto -> sqlx 0.9.0 -> sqlx-sqlite =0.9.0 + # (exact pin) -> libsqlite3-sys 0.37.0. openshell-annotate does not use SQLite itself. + # Remove this entry once an OpenShell release bumps sqlx/libsqlite3-sys and we move the pin to it. + "RUSTSEC-2026-0459", +] diff --git a/CHANGELOG.md b/CHANGELOG.md index b674428..cb24532 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ version section and adds the squash-merged PR titles since the previous tag. Ver ## [Unreleased] +- chore(audit): ignore RUSTSEC-2026-0459 (`libsqlite3-sys` 0.37.0, pinned by OpenShell v0.1.7 through `sqlx` 0.9.0) in `.cargo/audit.toml` until OpenShell upgrades it (#76) - chore(deps): build against OpenShell v0.1.7 (`openshell-policy-schema`, `openshell-policy`); docs and generated policy headers now name v0.1.7 - fix(diff-logs): ignore OCSF Network Activity Refuse records (policy DNS `policy_dns_ineligible`) that have no port, so OCSF JSON and shorthand logs report the same denials diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md index f0c5e66..368ea5b 100644 --- a/docs/DEVELOPING.md +++ b/docs/DEVELOPING.md @@ -83,6 +83,10 @@ turns a normal PR red. A failed *scheduled* run opens (or comments on) a single target, the upstream commit and a link to the log. The resolved upstream commit is in each run's job summary. When a target breaks, fix it on a branch (or bump the pin when `latest-release` moves on). +`cargo audit` ignores are listed in `.cargo/audit.toml`, each with its advisory and the condition for removing it. +Today that is `RUSTSEC-2026-0459` (`libsqlite3-sys` pinned by OpenShell's `sqlx`, #76): whenever you bump the OpenShell +pin, run `cargo tree -i libsqlite3-sys --target all` and drop the ignore once it resolves to 0.39.0 or newer. + ## 5. Try it on a tiny project ```