Zoltan Kochan
13d32215d4
## Summary The last structural step of the crate split from pnpm/pnpm#14191. Three modules now depend on nothing else inside `pnpr` — everything they touch is already its own crate — so each becomes one: | crate | contents | tests | | --- | --- | --- | | `pnpr-osv` | the OSV advisory index pnpr consults to refuse vulnerable versions | 14 | | `pnpr-search` | the local `/-/v1/search` scan over hosted packages | 7 | | `pnpr-shared-artifacts` | the shared build-artifact store: reservations, blobs, usage accounting | 23 | That leaves **`server` and `resolver`** in `pnpr` itself, which is where they belong — the HTTP surface and the install accelerator behind it, and the only pair left that genuinely references each other. Twelve items the boundaries caught as reaching across become `pub`; seven gained `#[must_use]` as newly public API. ### The whole split, end to end `pnpr` went from one 42k-line crate to **fourteen**, each named for what it holds: ``` pnpr-error → pnpr-package-name → pnpr-registry → pnpr-policy → pnpr-config → { pnpr-auth, pnpr-route, pnpr-upstream, pnpr-osv } → pnpr-storage → { pnpr-search, pnpr-shared-artifacts } → pnpr (server + resolver) ``` Layering is now checked by cargo rather than by convention.
236 lines
11 KiB
TOML
236 lines
11 KiB
TOML
# Configuration for cargo-deny (https://embarkstudios.github.io/cargo-deny/).
|
|
# The schema evolves fast; fields follow the 0.19+ format.
|
|
|
|
# --- Graph ---------------------------------------------------------------
|
|
[graph]
|
|
targets = []
|
|
all-features = false
|
|
no-default-features = false
|
|
|
|
# --- Output --------------------------------------------------------------
|
|
[output]
|
|
feature-depth = 1
|
|
|
|
# --- Advisories ----------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
|
|
[advisories]
|
|
db-path = "~/.cargo/advisory-db"
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
# Scope for RUSTSEC unmaintained advisories.
|
|
# One of "all", "workspace", "transitive", "none".
|
|
unmaintained = "workspace"
|
|
# yanked-crates check: "deny" | "warn" | "allow"
|
|
yanked = "warn"
|
|
ignore = [
|
|
# `pgp` pulls in `rsa` to verify OpenPGP signatures made by RSA Node.js
|
|
# release keys. Pacquet only performs public-key signature verification here;
|
|
# it never handles RSA private keys, so the private-key timing side channel
|
|
# described by this advisory is not reachable through this use.
|
|
{ id = "RUSTSEC-2023-0071", reason = "Only public-key OpenPGP signature verification is performed for pinned Node.js release keys; no RSA private-key operation is exposed." },
|
|
# hickory-proto 0.25.2 is pulled in transitively through reqwest 0.13.x ->
|
|
# hickory-resolver 0.25.x. The reqwest 0.13 line has not migrated to
|
|
# hickory-proto 0.26, so `cargo update` cannot resolve either advisory; the
|
|
# only paths forward are an upstream reqwest release on hickory 0.26 or
|
|
# dropping the `hickory-dns` reqwest feature, which would regress the macOS
|
|
# `mDNSResponder` / `EAI_NONAME` workaround landed in #302. Revisit when
|
|
# reqwest moves to hickory 0.26.
|
|
#
|
|
# NSEC3 closest-encloser proof unbounded loop in `DnssecDnsHandle`. The
|
|
# vulnerable path is only linked when hickory-proto is built with the
|
|
# `dnssec-ring` or `dnssec-aws-lc-rs` Cargo feature; reqwest's `hickory-dns`
|
|
# feature does not enable either, so the affected code is unreachable in
|
|
# pacquet. The advisory itself notes "No safe upgrade is available" for the
|
|
# 0.25 line.
|
|
{ id = "RUSTSEC-2026-0118", reason = "DNSSEC validation path is not linked: reqwest's `hickory-dns` feature does not enable hickory-proto's `dnssec-ring`/`dnssec-aws-lc-rs` features, and no fix exists on the 0.25 line." },
|
|
# O(n²) name compression in `BinEncoder` during DNS message encoding.
|
|
# Reachability is bounded: the BinEncoder is only invoked when reqwest's
|
|
# `hickory-dns` resolver builds outbound DNS queries for the registry
|
|
# hostnames pacquet resolves, which originate from `.npmrc` and so can be
|
|
# attacker-influenced in an untrusted-checkout / untrusted-CI scenario. We
|
|
# accept this temporary DoS risk because no upgrade is reachable: reqwest
|
|
# 0.13.x (latest 0.13.3) is locked to `hickory-resolver` 0.25, and the fix
|
|
# ships only in `hickory-proto` 0.26.1+. Revisit when reqwest moves to
|
|
# hickory 0.26.
|
|
{ id = "RUSTSEC-2026-0119", reason = "Temporary risk acceptance: reqwest 0.13.x (latest 0.13.3) is locked to hickory-resolver 0.25 and no release consumes hickory-proto 0.26.1+ yet; revisit on reqwest upgrade." },
|
|
# quick-xml DoS advisories (quadratic duplicate-attribute check, unbounded
|
|
# namespace-declaration allocation). quick-xml is reached only through
|
|
# object_store's S3 XML response parsing in pnpr, so the XML comes from the
|
|
# operator-configured S3-compatible storage backend, not from untrusted
|
|
# clients. Both fixes ship only in quick-xml 0.41.0, which no object_store
|
|
# release can resolve yet: object_store 0.13 requires ^0.39 and 0.14
|
|
# requires ^0.40.1. Revisit when object_store consumes quick-xml 0.41+.
|
|
{ id = "RUSTSEC-2026-0194", reason = "Temporary risk acceptance: XML parsed by quick-xml comes only from the operator-configured S3 backend via object_store; no object_store release consumes the patched quick-xml 0.41 yet." },
|
|
{ id = "RUSTSEC-2026-0195", reason = "Temporary risk acceptance: XML parsed by quick-xml comes only from the operator-configured S3 backend via object_store; no object_store release consumes the patched quick-xml 0.41 yet." },
|
|
# Unbounded queueing of empty HTTP/2 DATA frames (low-severity DoS). Only the
|
|
# `h2` 0.3 line is left unpatched here: pnpr's own HTTP/2 server surface runs
|
|
# on axum 0.8 -> hyper 1.x, which is on the fixed h2 0.4.16. The 0.3 copy is
|
|
# reached solely through libsql's gRPC client stack, whose `tonic` 0.11 and
|
|
# `hyper` 0.14 both depend on it directly. pnpr uses that client to talk out
|
|
# to the operator-configured libsql/sqld backend, so the frames it queues
|
|
# come from that backend rather than from untrusted registry clients. The fix
|
|
# ships only in h2 0.4.16 and 0.3.27 is the final 0.3 release, so no upgrade
|
|
# is reachable while the newest stable libsql (0.9.30) is pinned to tonic
|
|
# 0.11. Revisit when libsql 0.10 leaves prerelease.
|
|
#
|
|
# cargo-deny scopes an ignore to an advisory id, never to a version, so this
|
|
# entry would also silence the advisory on the 0.4 line. The `h2` bans below
|
|
# hold that line instead.
|
|
{ id = "RUSTSEC-2026-0258", reason = "Temporary risk acceptance: the unpatched h2 0.3 copy is reached only by libsql's outbound gRPC client to the operator-configured backend; pnpr's own server is on the patched h2 0.4.16, and no stable libsql release moves off tonic 0.11." },
|
|
]
|
|
|
|
# --- Licenses ------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
|
|
[licenses]
|
|
allow = [
|
|
"MIT",
|
|
"MPL-2.0", # required by mockito, used by crates/tarball tests and tasks/micro-benchmark
|
|
"Apache-2.0",
|
|
"Unicode-3.0", # newer ICU crates switched from Unicode-DFS-2016 to this
|
|
"Unicode-DFS-2016",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0",
|
|
"CDLA-Permissive-2.0", # `webpki-root-certs`, pulled in by reqwest's `rustls` feature
|
|
"ISC",
|
|
"Zlib", # required by foldhash, a transitive dep of rusqlite
|
|
]
|
|
confidence-threshold = 0.8
|
|
exceptions = [
|
|
# The first-party `pnpr*` crates are licensed under PolyForm Shield (see
|
|
# `pnpr/LICENSE.md`), not the MIT used by the rest of the workspace.
|
|
# cargo-deny only recognizes the PolyForm-Noncommercial identifier for this
|
|
# license text, so allow that id for just these crates (the clarify entries
|
|
# below pin it by file hash). Every new `pnpr-*` crate needs an entry here
|
|
# and a matching clarify block, or `Cargo Deny` fails it as unlicensed.
|
|
{ name = "pnpr", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-shared-artifacts", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-search", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-osv", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-auth", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-config", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-error", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-fixtures", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-package-name", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-policy", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-registry", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-route", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-storage", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-upstream", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-fixtures"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-auth"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-route"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-osv"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-search"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-shared-artifacts"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-storage"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-upstream"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-config"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-error"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-package-name"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-policy"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-registry"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
version = "*"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [
|
|
{ path = "LICENSE", hash = 0xbd0eed23 },
|
|
]
|
|
|
|
[licenses.private]
|
|
ignore = false
|
|
registries = []
|
|
|
|
# --- Bans ----------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
wildcards = "allow"
|
|
highlight = "all"
|
|
workspace-default-features = "allow"
|
|
external-default-features = "allow"
|
|
allow = []
|
|
deny = [
|
|
# RUSTSEC-2026-0258 is ignored above, and cargo-deny can only ignore an
|
|
# advisory for the whole workspace. These two bans keep that ignore from
|
|
# covering more than the one copy it was accepted for: a vulnerable `h2` on
|
|
# the 0.4 line is refused outright, and the unpatched 0.3 line stays reachable
|
|
# only from libsql's gRPC stack, whose `tonic` and `hyper` are its sole direct
|
|
# dependents. Drop both once libsql moves off tonic 0.11 and the ignore goes.
|
|
{ name = "h2", version = ">=0.4, <0.4.16" },
|
|
{ name = "h2", version = "<0.4", wrappers = ["hyper", "tonic"] },
|
|
]
|
|
skip = []
|
|
skip-tree = []
|
|
|
|
# --- Sources -------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
|
|
[sources]
|
|
unknown-registry = "warn"
|
|
unknown-git = "warn"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
allow-git = []
|
|
|
|
[sources.allow-org]
|
|
github = []
|
|
gitlab = []
|
|
bitbucket = []
|