hugo/MetaCrate
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Hardening: audit MSRV, dependencies, features, and supply chain #100

New Issue
Closed
opened 2026-08-08 08:26:25 +00:00 by hugo · 1 comment
hugo commented 2026-08-08 08:26:25 +00:00
Owner
Copy Link

Objective

Finalize MSRV and Cargo feature design; review every dependency for purpose, version, license, maintenance, native code, security advisories, and transitive cost.

Deliverables

  • Remove unused/speculative dependencies and duplicate capability stacks.
  • Run MSRV builds, dependency tree/duplicate checks, advisory/license audits, and feature-unification tests.
  • Document native build/runtime requirements and update policy.

Validation

  • MSRV and supported feature combinations build/test/document cleanly.
  • No unapproved advisory or license issue remains.
  • Each dependency maps to an implemented need in RUSTREWRITE.md.

Prerequisite

All implementation and program milestones are complete with their fixed parity suites green.

Project constraints

  • The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
  • Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
  • Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
## Objective Finalize MSRV and Cargo feature design; review every dependency for purpose, version, license, maintenance, native code, security advisories, and transitive cost. ## Deliverables - Remove unused/speculative dependencies and duplicate capability stacks. - Run MSRV builds, dependency tree/duplicate checks, advisory/license audits, and feature-unification tests. - Document native build/runtime requirements and update policy. ## Validation - MSRV and supported feature combinations build/test/document cleanly. - No unapproved advisory or license issue remains. - Each dependency maps to an implemented need in `RUSTREWRITE.md`. ## Prerequisite All implementation and program milestones are complete with their fixed parity suites green. ## Project constraints - The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit. - Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals. - Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
hugo added this to the 12 - Hardening and release milestone 2026-08-08 08:26:25 +00:00
hugo added the enhancement label 2026-08-08 08:26:25 +00:00
hugo commented 2026-08-11 22:57:49 +00:00
Author
Owner
Copy Link

Implemented and pushed in commit 9e3b532.

Implementation:

  • Replaced the unmaintained audiopus/audiopus_sys stack (RUSTSEC-2026-0150) with a private safe Rust libopus 1.3+ adapter. The reviewed ABI boundary owns encoder/decoder handles, validates sample rates/frame and packet shapes, requires exclusive mutation, and discovers libopus through pkg-config on Linux/macOS/Windows GNU or vcpkg on Windows MSVC.
  • Added a machine-checked policy for all 31 direct third-party dependencies and all 21 exact duplicate-version sets, including purpose, locked version, maintenance status, transitive cost, native-code status, consumers, scopes, and RUSTREWRITE mapping.
  • Added pinned cargo-deny 0.20.2 and cargo-machete 0.9.2 gates in an ubuntu-latest-only Gitea workflow. Advisory and license exceptions remain empty; non-crates.io sources, unreviewed graph drift, external wildcard requirements, and unused dependencies fail closed.
  • Documented the Rust 1.96 MSRV versus current stable, quarterly/immediate-security update policy, feature isolation, and Linux/Windows/macOS native build requirements. Extended the MSRV matrix to compile the libopus and WebRTC boundary.

Isolated validation on the final diff:

  • Rust 1.96 clean MSRV profile: 2/2 commands passed, including WebRTC/libopus.
  • Rust 1.97 current stable workspace all-target/all-feature unification: passed.
  • Strict issue-scoped all-feature Clippy and warning-free docs: passed.
  • Dependency policy audit: 31 direct crates and 21 reviewed duplicate sets passed.
  • cargo-deny: advisories ok, bans ok, licenses ok, sources ok.
  • cargo-machete: no unused dependencies.
  • libremetaverse-opus: 2/2 real system-codec tests passed.
  • libremetaverse-voice-webrtc: 5/5 tests passed, including encrypted UDP loopback Opus media and teardown.
  • Related compatibility test webrtc_protocol_semantics: 3/3 passed.
  • Standalone public API compile with its locked graph: passed.
  • Release-matrix audit and ubuntu-only workflow policy: passed.

No related test was skipped, and no advisory or license issue was ignored.

Implemented and pushed in commit 9e3b532. Implementation: - Replaced the unmaintained audiopus/audiopus_sys stack (RUSTSEC-2026-0150) with a private safe Rust libopus 1.3+ adapter. The reviewed ABI boundary owns encoder/decoder handles, validates sample rates/frame and packet shapes, requires exclusive mutation, and discovers libopus through pkg-config on Linux/macOS/Windows GNU or vcpkg on Windows MSVC. - Added a machine-checked policy for all 31 direct third-party dependencies and all 21 exact duplicate-version sets, including purpose, locked version, maintenance status, transitive cost, native-code status, consumers, scopes, and RUSTREWRITE mapping. - Added pinned cargo-deny 0.20.2 and cargo-machete 0.9.2 gates in an ubuntu-latest-only Gitea workflow. Advisory and license exceptions remain empty; non-crates.io sources, unreviewed graph drift, external wildcard requirements, and unused dependencies fail closed. - Documented the Rust 1.96 MSRV versus current stable, quarterly/immediate-security update policy, feature isolation, and Linux/Windows/macOS native build requirements. Extended the MSRV matrix to compile the libopus and WebRTC boundary. Isolated validation on the final diff: - Rust 1.96 clean MSRV profile: 2/2 commands passed, including WebRTC/libopus. - Rust 1.97 current stable workspace all-target/all-feature unification: passed. - Strict issue-scoped all-feature Clippy and warning-free docs: passed. - Dependency policy audit: 31 direct crates and 21 reviewed duplicate sets passed. - cargo-deny: advisories ok, bans ok, licenses ok, sources ok. - cargo-machete: no unused dependencies. - libremetaverse-opus: 2/2 real system-codec tests passed. - libremetaverse-voice-webrtc: 5/5 tests passed, including encrypted UDP loopback Opus media and teardown. - Related compatibility test webrtc_protocol_semantics: 3/3 passed. - Standalone public API compile with its locked graph: passed. - Release-matrix audit and ubuntu-only workflow policy: passed. No related test was skipped, and no advisory or license issue was ignored.
hugo closed this issue 2026-08-11 22:57:49 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 critical
duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 idea
ideas for later, not yet for implementation
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label enhancement
Milestone
No items
No Milestone 12 - Hardening and release
Projects
Clear projects
No project
Assignees
Clear assignees
hugo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: hugo/MetaCrate#100
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?