From 2c2c3702b0c610c15d8c79be40843bc5b353c6a8 Mon Sep 17 00:00:00 2001
From: Georg Bauer <gb@rfc1437.de>
Date: Mon, 31 Aug 2026 14:26:51 +0200
Subject: [PATCH] Add Cargo dependency audit gates

---
 .cargo/audit.toml                     | 21 +++++++++++++++++++++
 .gitea/workflows/dependency-audit.yml | 10 ++++++++++
 .gitea/workflows/release.yml          | 10 ++++++++++
 Cargo.lock                            |  4 ++--
 osv-scanner.toml                      | 16 ++++++++++++++++
 5 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 .cargo/audit.toml

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 0000000..0153cfb
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,21 @@
+[advisories]
+ignore = [
+    # Unmaintained transitive dependencies with no patched version.
+    "RUSTSEC-2020-0095", # difference via the release-only apple-codesign crate
+    "RUSTSEC-2024-0436", # paste via Iced's wgpu Metal backend
+    "RUSTSEC-2025-0134", # rustls-pemfile via apple-codesign's unused remote-signing stack
+    "RUSTSEC-2026-0192", # ttf-parser via Iced's text and SVG renderers
+    "RUSTSEC-2026-0206", # rustybuzz via Iced's SVG renderer
+
+    # No compatible upgrade exists; Cryoglyph does not call the affected LruCache::pop API.
+    "RUSTSEC-2026-0253",
+
+    # No patch exists; the release packager only creates ad-hoc signatures without RSA keys.
+    "RUSTSEC-2023-0071",
+]
+
+[output]
+deny = ["warnings"]
+format = "terminal"
+quiet = false
+show_tree = true
diff --git a/.gitea/workflows/dependency-audit.yml b/.gitea/workflows/dependency-audit.yml
index f6073d9..c4e9ad8 100644
--- a/.gitea/workflows/dependency-audit.yml
+++ b/.gitea/workflows/dependency-audit.yml
@@ -15,6 +15,16 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit@0.22.2
+
+      - name: Audit Rust dependencies
+        run: |
+          cargo audit
+          cargo audit --file tools/macos-packager/Cargo.lock
+
       - name: Scan dependencies for known vulnerabilities
         uses: docker://ghcr.io/google/osv-scanner:v2
         with:
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index b58836e..c554bb7 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -19,6 +19,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit@0.22.2
+
+      - name: Audit Rust dependencies
+        run: |
+          cargo audit
+          cargo audit --file tools/macos-packager/Cargo.lock
+
       - name: Test release-note generation
         run: python3 .gitea/scripts/release.py test
 
diff --git a/Cargo.lock b/Cargo.lock
index 6603b23..2ef2ac6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -266,9 +266,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
diff --git a/osv-scanner.toml b/osv-scanner.toml
index b5d2618..aa6e871 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -9,3 +9,19 @@ reason = "INFO Unmaintained with no patched version; transitive through Iced 0.1
 [[IgnoredVulns]]
 id = "RUSTSEC-2026-0192"
 reason = "INFO Unmaintained with no patched version; transitive through Iced 0.14's text and SVG renderers."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0253"
+reason = "No compatible Iced 0.14 upgrade; Cryoglyph does not call the affected LruCache::pop API."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2023-0071"
+reason = "No patched rsa release; the release packager only creates ad-hoc signatures without RSA keys."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2020-0095"
+reason = "INFO Unmaintained with no patched version; release-only transitive dependency through apple-codesign."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2025-0134"
+reason = "INFO Unmaintained with no patched version; transitive through apple-codesign's unused remote-signing stack."