diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index fa6c010f..c2d8ba51 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -102,7 +102,7 @@ check-zepter: stage: quick-checks script: - cargo metadata --format-version=1 --locked > /dev/null - - cargo install zepter@1.82.1 --locked -q + - cargo install zepter@1.82.1 --force - zepter --version - zepter run check @@ -204,7 +204,7 @@ cargo-deny-advisories: before_script: [] script: - cargo install cargo-deny --locked -q - - cargo deny check advisories --config deny.toml --exclude bizinikiwi-test-runtime-transaction-pool + - cargo deny check advisories --config deny.toml rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH - if: $CI_MERGE_REQUEST_IID @@ -216,7 +216,7 @@ cargo-deny-licenses: before_script: [] script: - cargo install cargo-deny --locked -q - - cargo deny check licenses --config deny.toml --exclude bizinikiwi-test-runtime-transaction-pool + - cargo deny check licenses --config deny.toml rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH - if: $CI_MERGE_REQUEST_IID @@ -241,16 +241,43 @@ cargo-audit: script: - cargo install cargo-audit --locked -q - | - cargo audit \ - --ignore RUSTSEC-2026-0006 \ - --ignore RUSTSEC-2026-0020 \ - --ignore RUSTSEC-2026-0021 \ - --ignore RUSTSEC-2026-0049 \ - --ignore RUSTSEC-2023-0071 \ - --ignore RUSTSEC-2025-0055 \ - --ignore RUSTSEC-2026-0067 \ - --ignore RUSTSEC-2026-0068 \ - 2>&1 | tee audit-output.txt || (cat audit-output.txt && exit 1) + # --json + python summary: avoids 4MB log overflow from full dependency trees + cargo audit --json 2>/dev/null | python3 -c " +import sys, json +data = json.load(sys.stdin) +ignore = { + # wasmtime: fix requires rustc 1.91.0+, toolchain pinned to 1.88.0 + 'RUSTSEC-2026-0006','RUSTSEC-2026-0020','RUSTSEC-2026-0021', + 'RUSTSEC-2026-0085','RUSTSEC-2026-0086','RUSTSEC-2026-0087', + 'RUSTSEC-2026-0088','RUSTSEC-2026-0089','RUSTSEC-2026-0091', + 'RUSTSEC-2026-0092','RUSTSEC-2026-0093','RUSTSEC-2026-0094', + 'RUSTSEC-2026-0095','RUSTSEC-2026-0096', + # rsa: no fixed version available + 'RUSTSEC-2023-0071', + # tracing-subscriber 0.2.x: pulled by arkworks internals, not our direct dep + 'RUSTSEC-2025-0055', + # rustls-webpki: transitive via kube-client, upgrade requires kube ecosystem bump + 'RUSTSEC-2026-0098','RUSTSEC-2026-0099', + # rand: unsound only with custom logger calling rand::rng() during init + 'RUSTSEC-2026-0097', + # lru: Stacked Borrows issue in IterMut, no user-facing exploit path + 'RUSTSEC-2026-0002', +} +vulns = data.get('vulnerabilities', {}).get('list', []) +fail = False +for v in vulns: + adv = v.get('advisory', {}) + pkg = v.get('package', {}) + aid = adv.get('id', '') + if aid in ignore: + print(f' [ignored] {aid} in {pkg.get(\"name\",\"?\")} {pkg.get(\"version\",\"?\")}') + else: + print(f' [FAIL] {aid} in {pkg.get(\"name\",\"?\")} {pkg.get(\"version\",\"?\")} — {adv.get(\"title\",\"?\")}') + fail = True +if fail: + sys.exit(1) +print(f'audit ok — {len(vulns)} advisories checked, all ignored or none found') +" allow_failure: false rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH diff --git a/bizinikiwi/test-utils/runtime/transaction-pool/Cargo.toml b/bizinikiwi/test-utils/runtime/transaction-pool/Cargo.toml index 23b08b45..f275755f 100644 --- a/bizinikiwi/test-utils/runtime/transaction-pool/Cargo.toml +++ b/bizinikiwi/test-utils/runtime/transaction-pool/Cargo.toml @@ -30,6 +30,7 @@ pezsp-runtime = { workspace = true, default-features = true } thiserror = { workspace = true } [features] +default = ["std"] runtime-benchmarks = [ "bizinikiwi-test-runtime-client/runtime-benchmarks", "pezsc-transaction-pool-api/runtime-benchmarks", diff --git a/deny.toml b/deny.toml index 389d3ceb..7a17aab7 100644 --- a/deny.toml +++ b/deny.toml @@ -7,9 +7,9 @@ targets = [ { triple = "x86_64-unknown-linux-gnu" }, { triple = "x86_64-unknown-linux-musl" }, ] -# Exclude no_std test runtime crates that cause krates crate to panic -# with "unable to locate std" when resolving the dependency graph. -exclude = ["bizinikiwi-test-runtime-transaction-pool"] +# all-features prevents krates 0.20+ from panicking with "unable to locate std" +# on workspace crates that have a std feature but don't enable it by default. +all-features = true # Advisory database - check for known vulnerabilities # In v2: all vulnerability/unsound/notice advisories automatically emit errors. @@ -20,26 +20,36 @@ yanked = "warn" # Track via quarterly review instead of blocking CI. unmaintained = "none" ignore = [ - # wasmtime 37.0.3: fix requires 42.0.2 but cranelift-assembler-x64 0.129+ needs - # rustc 1.91.0 — our toolchain is pinned to 1.88.0. Unblock by upgrading toolchain. - # Note: we do NOT use Winch backend or Component Model, so sandbox-escape CVEs - # (Winch/aarch64) and string-transcoding CVEs (Component Model) do not apply. - # Remaining real risk: pooling allocator data leakage (RUSTSEC-2026-0006). - "RUSTSEC-2026-0006", # wasmtime segfault with f64.copysign on x86-64 - "RUSTSEC-2026-0020", # wasmtime WASI guest-controlled resource exhaustion - "RUSTSEC-2026-0021", # wasmtime panic in wasi:http/types.fields + # ── wasmtime ────────────────────────────────────────────────────────────── + # Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+ + # Toolchain pinned to 1.88.0. Unblock when toolchain upgrades. + # We do NOT use Winch backend, Component Model, or 64-bit tables; + # most CVEs below only affect those code paths. + "RUSTSEC-2026-0006", # wasmtime: segfault with f64.copysign on x86-64 + "RUSTSEC-2026-0020", # wasmtime: WASI guest-controlled resource exhaustion + "RUSTSEC-2026-0021", # wasmtime: panic in wasi:http/types.fields + "RUSTSEC-2026-0085", # wasmtime: panic lifting flags component value + "RUSTSEC-2026-0086", # wasmtime: host data leakage 64-bit tables + Winch + "RUSTSEC-2026-0087", # wasmtime: segfault f64x2.splat on Cranelift x86-64 + "RUSTSEC-2026-0088", # wasmtime: data leakage pooling allocator instances + "RUSTSEC-2026-0089", # wasmtime: host panic table.fill with Winch + "RUSTSEC-2026-0091", # wasmtime: OOB write transcoding component model strings + "RUSTSEC-2026-0092", # wasmtime: panic transcoding misaligned UTF-16 strings + "RUSTSEC-2026-0093", # wasmtime: heap OOB read UTF-16 to latin1+utf16 + "RUSTSEC-2026-0094", # wasmtime: masked return value table.grow Winch + "RUSTSEC-2026-0095", # wasmtime: Winch sandbox-escaping memory access + "RUSTSEC-2026-0096", # wasmtime: miscompiled guest heap aarch64 Cranelift - # rsa 0.9.10: Marvin Attack timing sidechannel. Pulled transitively by - # sqlx-mysql (pezpallet-revive-eth-rpc). Not used for cryptographic signing. - "RUSTSEC-2023-0071", # rsa Marvin Attack + # ── rand 0.9.2 ──────────────────────────────────────────────────────────── + # Unsound only when a custom Rust logger calls rand::rng() during init. + # No custom logger in our stack. No fixed version available yet. + "RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng() - # tracing-subscriber 0.2.25: ANSI log injection. Pulled by ark-relations 0.5.1. - # Our 0.3.x is updated to 0.3.23 (fixed). 0.2.x used only by arkworks internals. - "RUSTSEC-2025-0055", # tracing-subscriber ANSI escape (0.2.x, arkworks transitive) - - # yamux 0.12.1: libp2p-yamux 0.47.0 (vendor/pezkuwi-zombienet-sdk) pins to 0.12.x. - # Fix requires 0.13.10. Upgrade path: update libp2p in zombienet vendor. - "RUSTSEC-2024-0428", # yamux remote panic via malformed Data frame (< 0.13.10) + # ── webpki ──────────────────────────────────────────────────────────────── + # Name-constraints validation bugs in transitive webpki dep. + # We do not rely on certificate name constraints in our P2P/RPC stack. + "RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted + "RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted ] # License compliance @@ -92,4 +102,7 @@ skip-tree = [] unknown-registry = "warn" unknown-git = "warn" allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] +allow-git = [ + # Our serde fork with wasm32v1-none target fix (pending upstream merge) + "https://github.com/pezkuwichain/serde.git", +]