From 93a08e9c65dd4ce692ae1082447887fb8f6b0527 Mon Sep 17 00:00:00 2001 From: Chili Palmer Date: Sat, 12 Sep 2026 10:22:38 +0200 Subject: [PATCH] Provision Cargo for complete RustSec registry checks (#122) --- .gitea/workflows/security-audit.yml | 6 +++--- crates/storage/tests/ssh_release_audit.rs | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/security-audit.yml b/.gitea/workflows/security-audit.yml index 34f2fb7..1cdbcbb 100644 --- a/.gitea/workflows/security-audit.yml +++ b/.gitea/workflows/security-audit.yml @@ -15,13 +15,13 @@ jobs: - name: Check out the repository uses: actions/checkout@v4 - - name: Install the reviewed cargo-audit release + - name: Install Rust and the reviewed cargo-audit release uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2 with: - tool: cargo-audit@0.22.2 + tool: rust@1.92.0,cargo-audit@0.22.2 fallback: none - name: Reject new RustSec vulnerabilities - # Invoke the prebuilt binary directly: the runner has no Cargo toolchain. + # RustSec's registry checks require Cargo even with a prebuilt audit binary. # The existing RSA exception is documented in docs/ssh-transport-audit.md. run: cargo-audit audit --ignore RUSTSEC-2023-0071 diff --git a/crates/storage/tests/ssh_release_audit.rs b/crates/storage/tests/ssh_release_audit.rs index 5c093ca..4e13e98 100644 --- a/crates/storage/tests/ssh_release_audit.rs +++ b/crates/storage/tests/ssh_release_audit.rs @@ -20,7 +20,7 @@ fn release_feature_and_advisory_boundaries_stay_explicit() { } assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]")); assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]")); - assert!(AUDIT_WORKFLOW.contains("tool: cargo-audit@0.22.2")); + assert!(AUDIT_WORKFLOW.contains("tool: rust@1.92.0,cargo-audit@0.22.2")); assert!(AUDIT_WORKFLOW.contains("fallback: none")); assert!(!AUDIT_WORKFLOW.contains("cargo install")); assert!(AUDIT_WORKFLOW.contains("run: cargo-audit audit --ignore RUSTSEC-2023-0071"));