chore: add audit.toml to ignore known unmaintained crates #3570
Conversation
|
@niklaslong could you review? I can't set reviewers it seems. |
|
I think this is a reasonable approach to take, though we should be very strict with the advisories we choose to include here. It might also be a good practice to periodically review this list. Could you also add comments to the file explaining why each advisory is ignored and perhaps link to relevant discussions? |
|
Absolutely, we should think hard about adding anything to this list. There exists a fork of |
Agreed! 👍 |
|
Looks good to me! Should we create an issue for each unmaintained dependency, so we don't forget about it? For |
@joske We should indeed just try to get rid of ansi_term, its use seems to be limited. Then we can remove that from the ignore list. Can you also add a CI job which runs cargo audit? Also for snarkVM?
And yes we can make an issue to track the situation of the paste dependency... |
joske
force-pushed
the
audit
branch
3 times, most recently
from
7365dd7 to
9b29f7f
Compare
|
@vicsn (github) workflow added. It will fail on any warning. |
|
Apparently |
joske
force-pushed
the
audit
branch
2 times, most recently
from
1a2cfde to
5e9ed77
Compare
|
|
Cargo.toml
Outdated
| incremental = true | ||
| debug = true | ||
| debug-assertions = true | ||
| debug-assertions = false |
There was a problem hiding this comment.
You can introduce profile changes in a separate PR with explanation if you think they're a good idea. In the past changing some of this slowed down CI, and I'm not sure we'd want to turn off debug assertions...
There was a problem hiding this comment.
oh this is a mistake! Good catch!
|
BTW, the audit workflow will fail until the cargo update PRs are merged (#3589 and the relevant one in snarkVM). |
.integration/Cargo.toml
Outdated
| name = "snarkos-integration" | ||
| version = "3.5.0" | ||
| authors = [ "The Aleo Team <[email protected]>" ] | ||
| description = "A integration testing suite for a decentralized operating system" |
There was a problem hiding this comment.
| description = "A integration testing suite for a decentralized operating system" | |
| description = "An integration testing suite for a decentralized operating system" |
There was a problem hiding this comment.
oh I did not see this is a new folder. Not sure where that came from.
.integration/Cargo.toml
Outdated
| @@ -0,0 +1,37 @@ | |||
| [package] | |||
| name = "snarkos-integration" | |||
There was a problem hiding this comment.
Why do we need a new crate?
| @@ -0,0 +1,20 @@ | |||
| name: Cargo Audit | |||
There was a problem hiding this comment.
We might want to unify this job with the existing circle workflow instead?
There was a problem hiding this comment.
Could do. Is that preferred?
Motivation
cargo auditcomplains thatansi_termandpastecrates are unmaintained.For
paste: As the rust community considers this 'done', we can safely ignore this warning.For
ansi_term: Crate was unmaintained for 4 years. Removed this dependency.Test Plan
no actual code changes