diff --git a/Cargo.lock b/Cargo.lock index 0d0045e..b356177 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -683,9 +683,9 @@ dependencies = [ [[package]] name = "ewf" -version = "0.4.6" +version = "0.4.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e2826fead9ad5abeea14997e175628ddd143ee5f366364b5ae94372fafa78ce" +checksum = "91ed8c21f060b936723663fe832dcbe25edac7c0a4f323b308033132f5d075ca" dependencies = [ "adler2", "flate2", @@ -695,6 +695,7 @@ dependencies = [ "lru", "md-5", "rayon", + "safe-read 0.2.1", "sha-1", "thiserror", ] @@ -774,9 +775,9 @@ dependencies = [ [[package]] name = "foldhash" -version = "0.1.5" +version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" [[package]] name = "forensic-vfs" @@ -926,21 +927,15 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" [[package]] name = "hashbrown" -version = "0.15.5" +version = "0.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" +checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" dependencies = [ "allocator-api2", "equivalent", "foldhash", ] -[[package]] -name = "hashbrown" -version = "0.17.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" - [[package]] name = "hex" version = "0.4.3" @@ -1009,7 +1004,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9" dependencies = [ "equivalent", - "hashbrown 0.17.1", + "hashbrown", ] [[package]] @@ -1097,11 +1092,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" [[package]] name = "lru" -version = "0.12.5" +version = "0.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38" +checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a" dependencies = [ - "hashbrown 0.15.5", + "hashbrown", ] [[package]] diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 4e59008..921e9ad 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -73,7 +73,7 @@ end = "2027-08-05" criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-03-05" -end = "2027-08-05" +end = "2027-08-06" [[trusted.ext4fs-core]] criteria = "safe-to-deploy" @@ -97,7 +97,7 @@ end = "2027-08-05" criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-07-07" -end = "2027-08-05" +end = "2027-08-06" [[trusted.forensic-vfs-resolver]] criteria = "safe-to-deploy" @@ -109,19 +109,19 @@ end = "2027-08-05" criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-05" -end = "2027-08-05" +end = "2027-08-06" [[trusted.forensicnomicon-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-05" +end = "2027-08-06" [[trusted.forensicnomicon-data]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-28" -end = "2027-08-05" +end = "2027-08-06" [[trusted.hfsplus-forensic]] criteria = "safe-to-deploy" @@ -175,7 +175,7 @@ end = "2027-08-06" criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) start = "2026-06-16" -end = "2027-08-05" +end = "2027-08-06" [[trusted.udf-forensic]] criteria = "safe-to-deploy" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 4f7bfb5..e94b9a0 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -255,10 +255,6 @@ criteria = "safe-to-deploy" version = "0.4.3" criteria = "safe-to-deploy" -[[exemptions.glob]] -version = "0.3.3" -criteria = "safe-to-deploy" - [[exemptions.hashbrown]] version = "0.15.5" criteria = "safe-to-deploy" @@ -275,10 +271,6 @@ criteria = "safe-to-deploy" version = "0.1.65" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.inout]] version = "0.1.4" criteria = "safe-to-deploy" @@ -316,7 +308,7 @@ version = "0.4.33" criteria = "safe-to-deploy" [[exemptions.lru]] -version = "0.12.5" +version = "0.18.2" criteria = "safe-to-deploy" [[exemptions.lz4_flex]] @@ -375,10 +367,6 @@ criteria = "safe-to-deploy" version = "0.41.0" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.47" -criteria = "safe-to-deploy" - [[exemptions.r-efi]] version = "6.0.0" criteria = "safe-to-deploy" @@ -415,10 +403,6 @@ criteria = "safe-to-deploy" version = "0.8.3" criteria = "safe-to-deploy" -[[exemptions.semver]] -version = "1.0.28" -criteria = "safe-to-deploy" - [[exemptions.serde]] version = "1.0.229" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index ea33676..e936190 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -100,8 +100,8 @@ user-login = "h4x0r" user-name = "Albert Hui" [[publisher.ewf]] -version = "0.4.6" -when = "2026-07-20" +version = "0.4.9" +when = "2026-08-06" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" @@ -402,6 +402,12 @@ criteria = "safe-to-deploy" version = "0.2.19" notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." +[[audits.bytecode-alliance.audits.semver]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "1.0.17" +notes = "plenty of unsafe pointer and vec tricks, but in well-structured and commented code that appears to be correct" + [[audits.bytecode-alliance.audits.static_assertions]] who = "Andrew Brown " criteria = "safe-to-deploy" @@ -516,6 +522,87 @@ delta = "0.1.4 -> 0.1.5" notes = "No new `unsafe`." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.glob]] +who = "George Burgess IV " +criteria = "safe-to-deploy" +version = "0.3.1" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.0.35" +notes = """ +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits +(except for benign "net" hit in tests and "fs" hit in README.md) +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Adrian Taylor " +criteria = "safe-to-deploy" +delta = "1.0.35 -> 1.0.36" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.36 -> 1.0.37" +notes = """ +The delta just 1) inlines/expands `impl ToTokens` that used to be handled via +`primitive!` macro and 2) adds `impl ToTokens` for `CStr` and `CString`. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Dustin J. Mitchell " +criteria = "safe-to-deploy" +delta = "1.0.37 -> 1.0.38" +notes = "Still no unsafe" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Daniel Cheng " +criteria = "safe-to-deploy" +delta = "1.0.38 -> 1.0.39" +notes = "Only minor changes for clippy lints and documentation." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.quote]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.0.39 -> 1.0.40" +notes = """ +The delta is just a simplification of how `tokens.extend(...)` call is made. +Still no `unsafe` anywhere. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.rand_core]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -549,6 +636,19 @@ criteria = "safe-to-deploy" delta = "1.15.0 -> 1.16.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.foldhash]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.1.5 -> 0.2.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.glob]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "0.3.1 -> 0.3.3" +notes = "Very few changes. No new unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -579,6 +679,44 @@ criteria = "safe-to-deploy" version = "0.4.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.indexmap]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "2.8.0 -> 2.11.4" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.indexmap]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "2.11.4 -> 2.14.0" +notes = "Mostly internal refactorings. No new unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.quote]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.40 -> 1.0.45" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.quote]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.45 -> 1.0.47" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.semver]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "1.0.16 -> 1.0.28" +notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.semver]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +delta = "1.0.17 -> 1.0.16" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.zip]] who = "Alex Franchuk " criteria = "safe-to-deploy"