h-dv/code-index

Fork 0

CI/supply-chain: no cargo-deny / cargo-audit gate despite bundling SQLite + 8 C grammar crates #17

New issue

Closed

opened 2026-07-07 13:19:31 +02:00 by buildagent · 1 comment

buildagent commented

2026-07-07 13:19:31 +02:00

Member

Severity: Medium · Category: Tech-debt / supply chain

CI (.forgejo/workflows/ci.yml) runs fmt → clippy (-D warnings) → test, but has no advisory/CVE step. The riskiest (C-FFI) part of the tree is unguarded: libsqlite3-sys (SQLite compiled from source via rusqlite bundled) + 8 tree-sitter grammar crates (C parsers) + rmcp 1.5. No automated CVE/yank/license gate.

Fix

Add a cargo-deny CI job (advisories + bans + licenses); commit deny.toml.

Tree-sitter version skew: core tree-sitter 0.22.6 vs grammars 0.21.x (php 0.22.8). Compiles + all tests pass (ABI 14), so it works today, but the coupling is implicit/unpinned — a future grammar bump to a newer ABI would break at load time, not compile time. Tracked in the polish backlog.

Filed from a deep multi-agent code review of the workspace (v0.5.7). Severity/category per the review; file:line refs were accurate at review time — verify against current master.

**Severity:** Medium · **Category:** Tech-debt / supply chain CI (`.forgejo/workflows/ci.yml`) runs fmt → clippy (`-D warnings`) → test, but has **no advisory/CVE step**. The riskiest (C-FFI) part of the tree is unguarded: `libsqlite3-sys` (SQLite compiled from source via `rusqlite bundled`) + 8 tree-sitter grammar crates (C parsers) + `rmcp 1.5`. No automated CVE/yank/license gate. ### Fix - Add a `cargo-deny` CI job (advisories + bans + licenses); commit `deny.toml`. ### Related low item - Tree-sitter version skew: core `tree-sitter 0.22.6` vs grammars `0.21.x` (php `0.22.8`). Compiles + all tests pass (ABI 14), so it works today, but the coupling is implicit/unpinned — a future grammar bump to a newer ABI would break at load time, not compile time. Tracked in the polish backlog. --- _Filed from a deep multi-agent code review of the workspace (v0.5.7). Severity/category per the review; file:line refs were accurate at review time — verify against current `master`._

buildagent added the

severity/medium

tech-debt

code-review

labels

2026-07-07 13:19:31 +02:00

buildagent commented

2026-07-07 14:41:23 +02:00

Author

Member

Fixed in 5bdd1ba (branch fix/ultradeep-review-findings).

Reassessed on current master — confirmed no advisory step existed (ci.yml = fmt → clippy → test, no deny.toml). Added:

deny.toml — advisories (RustSec DB, yanked = "deny"), licenses (the permissive set actually present in the lock: MIT / Apache-2.0 / Apache-2.0-WITH-LLVM-exception / BSD-2 / ISC / Unicode-3.0 / Zlib / CC0-1.0 / BSL-1.0), sources (crates.io only), bans.multiple-versions = "warn" (non-fatal).
ci.yml — new deny job wired as fmt → {clippy, deny} → test, running cargo deny check advisories bans licenses sources.

The gate immediately earned its keep — it flagged two real upstream advisories, now remediated by a lockfile bump (no API changes):

RUSTSEC-2026-0190 (unsound) — anyhow 1.0.102 → 1.0.103 (Error::downcast_mut borrow-rule UB)
RUSTSEC-2026-0204 (vulnerability) — crossbeam-epoch 0.9.18 → 0.9.20 (null-pointer deref in Display), via ignore/rayon-core

Verified locally: cargo deny check → advisories ok, bans ok, licenses ok, sources ok; full workspace suite green (624 tests).

Note: the CI job builds cargo-deny from source (cargo install cargo-deny --locked) since this repo doesn't use install-action; a cached binary could speed it up later if runner minutes matter.

Fixed in `5bdd1ba` (branch `fix/ultradeep-review-findings`). Reassessed on current master — confirmed no advisory step existed (`ci.yml` = fmt → clippy → test, no `deny.toml`). Added: - **`deny.toml`** — advisories (RustSec DB, `yanked = "deny"`), licenses (the permissive set actually present in the lock: MIT / Apache-2.0 / Apache-2.0-WITH-LLVM-exception / BSD-2 / ISC / Unicode-3.0 / Zlib / CC0-1.0 / BSL-1.0), sources (crates.io only), `bans.multiple-versions = "warn"` (non-fatal). - **`ci.yml`** — new `deny` job wired as fmt → {clippy, deny} → test, running `cargo deny check advisories bans licenses sources`. **The gate immediately earned its keep** — it flagged two real upstream advisories, now remediated by a lockfile bump (no API changes): - **RUSTSEC-2026-0190** (unsound) — `anyhow` 1.0.102 → **1.0.103** (`Error::downcast_mut` borrow-rule UB) - **RUSTSEC-2026-0204** (vulnerability) — `crossbeam-epoch` 0.9.18 → **0.9.20** (null-pointer deref in `Display`), via `ignore`/`rayon-core` Verified locally: `cargo deny check` → **advisories ok, bans ok, licenses ok, sources ok**; full workspace suite green (624 tests). Note: the CI job builds cargo-deny from source (`cargo install cargo-deny --locked`) since this repo doesn't use `install-action`; a cached binary could speed it up later if runner minutes matter.

buildagent closed this issue

2026-07-07 14:41:24 +02:00

dhoyer referenced this issue from a commit

2026-07-07 16:31:03 +02:00

ci(supply-chain): add cargo-deny gate + fix the two CVEs it surfaced (#17)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

h-dv/code-index#17

No description provided.

Rows
Columns