2 # cargo-vet config file
7 [imports.bytecode-alliance]
8 url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml"
10 [imports.embark-studios]
11 url = "https://raw.githubusercontent.com/EmbarkStudios/rust-ecosystem/main/audits.toml"
14 url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
17 url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"
20 url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
23 audit-as-crates-io = true
24 notes = "This is the upstream code plus a few local fixes, see bug 1685697."
27 audit-as-crates-io = true
28 notes = "This is a crate Henri wrote which is also published. We should probably update Firefox to tip and certify that."
31 audit-as-crates-io = true
32 notes = "This is a crate Henri wrote which is also published. We should probably update Firefox to tip and certify that."
35 audit-as-crates-io = true
36 notes = "This is a pinned version of the upstream code, presumably to get a fix that hadn't been released yet. We should consider switching to the latest official release."
39 audit-as-crates-io = true
40 notes = "Upstream code plus nesting changes that haven't been published yet authored by us"
42 [policy.cssparser-macros]
43 audit-as-crates-io = true
44 notes = "Needed because this crate lives along cssparser"
47 audit-as-crates-io = true
48 notes = "Unpublished wgpu revisions point to unpublished d3d12 revisions."
50 [policy.firefox-on-glean]
51 audit-as-crates-io = false
52 notes = "The crates.io version of this is just a placeholder to allow public crates to depend on firefox-on-glean."
55 audit-as-crates-io = false
56 criteria = "safe-to-run"
57 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here. It's also used only for automation, so its subtree can be safe-to-run."
60 criteria = "safe-to-run"
61 notes = "Used for testing."
63 [policy.gkrust-shared]
64 dependency-criteria = { tokio-reactor = [], tokio-threadpool = [] }
65 notes = "The dependencies on tokio-reactor and tokio-threadpools are just a hack to pin the version used by audioipc-{client,server}. Suppress vetting on those for the same reasons behind the policy entries."
68 criteria = "safe-to-run"
69 notes = "Used for fuzzing."
72 criteria = "safe-to-run"
73 notes = "Used for testing."
76 dependency-criteria = { fluent-testing = "safe-to-run", tokio = "safe-to-run" }
77 notes = "This crate has two testing-only dependencies which are specified as regular-but-optional rather than a dev-dependencies, because they need to be available to both benchmarks and integration tests."
80 audit-as-crates-io = false
81 notes = "This override is an api-compatible fork with an orthogonal implementation."
84 audit-as-crates-io = false
85 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here."
88 audit-as-crates-io = true
89 notes = "This is a pinned version of the upstream code, presumably to get a fix that hadn't been released yet. We should consider switching to the latest official release."
92 audit-as-crates-io = true
93 notes = "Version 0.6.23 is a local fork of upstream which just twiddles some dependencies."
96 audit-as-crates-io = false
97 notes = "The crates.io version of this is just a placeholder to allow public crates to depend on mozbuild."
100 audit-as-crates-io = false
101 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here."
103 [policy.mozglue-static]
104 dependency-criteria = { rustc_version = "safe-to-run" }
105 notes = "The rustc_version dependency is only used in the build script, and does not generate any runtime code"
108 audit-as-crates-io = false
109 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here."
112 audit-as-crates-io = false
113 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here."
116 audit-as-crates-io = false
117 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here."
120 audit-as-crates-io = false
122 [policy.mp4parse_capi]
123 audit-as-crates-io = false
126 audit-as-crates-io = true
127 notes = "wgpu-core pins this crate."
129 [policy.packed_simd_2]
130 audit-as-crates-io = true
131 notes = "Based on upstream, see bug 1719674."
134 audit-as-crates-io = false
136 [policy.peek-poke-derive]
137 audit-as-crates-io = false
140 audit-as-crates-io = false
141 notes = "This is a first-party crate which is entirely unrelated to the crates.io package of the same name."
144 audit-as-crates-io = true
145 notes = "This is a first-party crate which is also published to crates.io, but we should publish audits for it for the benefit of the ecosystem."
148 audit-as-crates-io = true
149 notes = "Identical to upstream, but with cdylib and staticlib targets disabled to avoid unnecessary build artifacts and linker errors."
152 audit-as-crates-io = true
153 notes = "This is a first-party crate which is also published to crates.io, but we should publish audits for it for the benefit of the ecosystem."
156 audit-as-crates-io = true
157 notes = "This is a first-party crate which is also published to crates.io, but we should publish audits for it for the benefit of the ecosystem."
160 criteria = "safe-to-run"
161 notes = "We're not shipping this and have no plans to ship it."
164 audit-as-crates-io = false
165 notes = "This is a first-party crate which is entirely unrelated to the crates.io package of the same name."
168 audit-as-crates-io = false
169 notes = "This is a first-party crate, maintained by the appservices team, which is entirely unrelated to the crates.io package of the same name."
172 audit-as-crates-io = false
173 notes = "This is a first-party crate, maintained by the appservices team, which is entirely unrelated to the crates.io package of the same name."
176 audit-as-crates-io = true
177 notes = "This is a third-party crate, with an extra patch."
180 audit-as-crates-io = false
181 criteria = "safe-to-run"
182 notes = "This is a first-party crate which is also published to crates.io. We certify audits for this crate as part of the documented release process, but that step happens after the version bump lands on central so we don't enforce it here. It's also used only for automation, so its subtree can be safe-to-run."
185 audit-as-crates-io = false
187 [policy.webrender_api]
188 audit-as-crates-io = false
190 [policy.webrender_build]
191 audit-as-crates-io = false
194 audit-as-crates-io = true
195 notes = "Upstream project which we pin."
198 audit-as-crates-io = true
199 notes = "Upstream project which we pin."
202 audit-as-crates-io = true
203 notes = "Upstream project which we pin."
205 [policy.wr_malloc_size_of]
206 audit-as-crates-io = false
210 criteria = "safe-to-deploy"
214 criteria = "safe-to-deploy"
218 criteria = "safe-to-deploy"
220 [[exemptions.alsa-sys]]
222 criteria = "safe-to-deploy"
224 [[exemptions.android_log-sys]]
226 criteria = "safe-to-deploy"
228 [[exemptions.askama_derive]]
230 criteria = "safe-to-deploy"
232 [[exemptions.askama_escape]]
234 criteria = "safe-to-deploy"
236 [[exemptions.askama_shared]]
238 criteria = "safe-to-deploy"
240 [[exemptions.async-task]]
242 criteria = "safe-to-deploy"
244 [[exemptions.bincode]]
246 criteria = "safe-to-deploy"
248 [[exemptions.bitflags]]
250 criteria = "safe-to-deploy"
252 [[exemptions.bitreader]]
254 criteria = "safe-to-deploy"
258 criteria = "safe-to-deploy"
260 [[exemptions.cache-padded]]
262 criteria = "safe-to-deploy"
264 [[exemptions.camino]]
266 criteria = "safe-to-deploy"
268 [[exemptions.chrono]]
270 criteria = "safe-to-deploy"
272 [[exemptions.chunky-vec]]
274 criteria = "safe-to-deploy"
276 [[exemptions.clang-sys]]
278 criteria = "safe-to-deploy"
282 criteria = "safe-to-deploy"
284 [[exemptions.clap_derive]]
286 criteria = "safe-to-deploy"
288 [[exemptions.clap_lex]]
290 criteria = "safe-to-deploy"
292 [[exemptions.cookie]]
294 criteria = "safe-to-run"
296 [[exemptions.coreaudio-sys]]
298 criteria = "safe-to-deploy"
300 [[exemptions.coremidi]]
301 version = "0.6.0@git:fc68464b5445caf111e41f643a2e69ccce0b4f83"
302 criteria = "safe-to-deploy"
304 [[exemptions.coremidi-sys]]
306 criteria = "safe-to-deploy"
310 criteria = "safe-to-deploy"
312 [[exemptions.cose-c]]
314 criteria = "safe-to-deploy"
316 [[exemptions.cpufeatures]]
318 criteria = "safe-to-deploy"
320 [[exemptions.crc32fast]]
322 criteria = "safe-to-deploy"
324 [[exemptions.crossbeam-channel]]
326 criteria = "safe-to-deploy"
328 [[exemptions.crossbeam-deque]]
330 criteria = "safe-to-deploy"
332 [[exemptions.crossbeam-epoch]]
334 criteria = "safe-to-deploy"
336 [[exemptions.crossbeam-utils]]
338 criteria = "safe-to-deploy"
342 criteria = "safe-to-deploy"
344 [[exemptions.darling]]
346 criteria = "safe-to-deploy"
348 [[exemptions.darling_core]]
350 criteria = "safe-to-deploy"
352 [[exemptions.darling_macro]]
354 criteria = "safe-to-deploy"
356 [[exemptions.dashmap]]
358 criteria = "safe-to-deploy"
360 [[exemptions.data-encoding]]
362 criteria = "safe-to-deploy"
366 criteria = "safe-to-deploy"
368 [[exemptions.devd-rs]]
370 criteria = "safe-to-deploy"
372 [[exemptions.digest]]
374 criteria = "safe-to-deploy"
378 criteria = "safe-to-deploy"
380 [[exemptions.dirs-sys]]
382 criteria = "safe-to-deploy"
384 [[exemptions.dns-parser]]
386 criteria = "safe-to-deploy"
388 [[exemptions.enumset]]
390 criteria = "safe-to-deploy"
392 [[exemptions.enumset_derive]]
394 criteria = "safe-to-deploy"
396 [[exemptions.env_logger]]
398 criteria = "safe-to-deploy"
400 [[exemptions.error-chain]]
402 criteria = "safe-to-deploy"
404 [[exemptions.fallible-iterator]]
406 criteria = "safe-to-deploy"
408 [[exemptions.fallible-streaming-iterator]]
410 criteria = "safe-to-deploy"
412 [[exemptions.fallible_collections]]
414 criteria = "safe-to-deploy"
416 [[exemptions.ffi-support]]
418 criteria = "safe-to-deploy"
420 [[exemptions.float-cmp]]
422 criteria = "safe-to-deploy"
424 [[exemptions.fs-err]]
426 criteria = "safe-to-deploy"
428 [[exemptions.fuchsia-zircon]]
430 criteria = "safe-to-run"
432 [[exemptions.fuchsia-zircon-sys]]
434 criteria = "safe-to-run"
436 [[exemptions.futures]]
438 criteria = "safe-to-deploy"
440 [[exemptions.futures-macro]]
442 criteria = "safe-to-deploy"
444 [[exemptions.futures-task]]
446 criteria = "safe-to-deploy"
448 [[exemptions.futures-util]]
450 criteria = "safe-to-deploy"
452 [[exemptions.generic-array]]
454 criteria = "safe-to-deploy"
456 [[exemptions.getrandom]]
458 criteria = "safe-to-deploy"
460 [[exemptions.gl_generator]]
462 criteria = "safe-to-deploy"
466 criteria = "safe-to-deploy"
468 [[exemptions.goblin]]
470 criteria = "safe-to-deploy"
472 [[exemptions.gpu-alloc]]
474 criteria = "safe-to-deploy"
476 [[exemptions.gpu-alloc-types]]
478 criteria = "safe-to-deploy"
480 [[exemptions.gpu-descriptor]]
482 criteria = "safe-to-deploy"
484 [[exemptions.gpu-descriptor-types]]
486 criteria = "safe-to-deploy"
488 [[exemptions.hashlink]]
490 criteria = "safe-to-deploy"
492 [[exemptions.hermit-abi]]
494 criteria = "safe-to-deploy"
496 [[exemptions.hexf-parse]]
498 criteria = "safe-to-deploy"
500 [[exemptions.instant]]
502 criteria = "safe-to-deploy"
504 [[exemptions.ioctl-sys]]
506 criteria = "safe-to-deploy"
508 [[exemptions.itertools]]
510 criteria = "safe-to-deploy"
512 [[exemptions.khronos-egl]]
514 criteria = "safe-to-deploy"
516 [[exemptions.khronos_api]]
518 criteria = "safe-to-deploy"
520 [[exemptions.lazycell]]
522 criteria = "safe-to-deploy"
524 [[exemptions.libdbus-sys]]
526 criteria = "safe-to-deploy"
528 [[exemptions.libloading]]
530 criteria = "safe-to-deploy"
532 [[exemptions.libsqlite3-sys]]
534 criteria = "safe-to-deploy"
536 notes = "The in-gecko feature that we enable makes only pre-built bindings used, and none of the embedded C code is built. The build script was audited and is not doing anything besides exposing those bindings"
538 [[exemptions.libudev]]
540 criteria = "safe-to-deploy"
542 [[exemptions.line-wrap]]
544 criteria = "safe-to-run"
546 [[exemptions.lmdb-rkv-sys]]
548 criteria = "safe-to-deploy"
550 notes = "This crate is forked from another crate and not developed in-house. Given that LMDB-backed RKV is going away, we will probably never bother auditing this"
554 criteria = "safe-to-deploy"
556 [[exemptions.memalloc]]
558 criteria = "safe-to-deploy"
560 [[exemptions.memmap2]]
562 criteria = "safe-to-deploy"
564 [[exemptions.memoffset]]
566 criteria = "safe-to-deploy"
570 criteria = "safe-to-deploy"
574 criteria = "safe-to-deploy"
576 [[exemptions.mime_guess]]
578 criteria = "safe-to-deploy"
580 [[exemptions.minimal-lexical]]
582 criteria = "safe-to-deploy"
584 [[exemptions.miniz_oxide]]
586 criteria = "safe-to-deploy"
590 criteria = "safe-to-deploy"
592 [[exemptions.mio-extras]]
594 criteria = "safe-to-run"
598 criteria = "safe-to-deploy"
600 [[exemptions.murmurhash3]]
602 criteria = "safe-to-deploy"
606 criteria = "safe-to-run"
610 criteria = "safe-to-deploy"
614 criteria = "safe-to-deploy"
618 criteria = "safe-to-deploy"
622 criteria = "safe-to-deploy"
624 [[exemptions.objc_exception]]
626 criteria = "safe-to-deploy"
628 [[exemptions.object]]
630 criteria = "safe-to-deploy"
632 [[exemptions.once_cell]]
634 criteria = "safe-to-deploy"
636 [[exemptions.os_str_bytes]]
638 criteria = "safe-to-deploy"
642 criteria = "safe-to-deploy"
644 [[exemptions.owning_ref]]
646 criteria = "safe-to-deploy"
648 [[exemptions.packed_simd_2]]
650 criteria = "safe-to-deploy"
654 criteria = "safe-to-deploy"
656 [[exemptions.phf_codegen]]
658 criteria = "safe-to-deploy"
660 [[exemptions.phf_generator]]
662 criteria = "safe-to-deploy"
664 [[exemptions.phf_macros]]
666 criteria = "safe-to-deploy"
668 [[exemptions.phf_shared]]
670 criteria = "safe-to-deploy"
672 [[exemptions.pin-project-lite]]
674 criteria = "safe-to-deploy"
678 criteria = "safe-to-deploy"
682 criteria = "safe-to-run"
684 [[exemptions.ppv-lite86]]
686 criteria = "safe-to-deploy"
688 [[exemptions.proc-macro-error]]
690 criteria = "safe-to-deploy"
692 [[exemptions.profiling]]
694 criteria = "safe-to-deploy"
698 criteria = "safe-to-deploy"
700 [[exemptions.prost-derive]]
702 criteria = "safe-to-deploy"
706 criteria = "safe-to-deploy"
708 [[exemptions.quick-error]]
710 criteria = "safe-to-deploy"
714 criteria = "safe-to-deploy"
716 [[exemptions.rand_chacha]]
718 criteria = "safe-to-deploy"
720 [[exemptions.rand_core]]
722 criteria = "safe-to-deploy"
724 [[exemptions.redox_syscall]]
726 criteria = "safe-to-deploy"
728 [[exemptions.remove_dir_all]]
730 criteria = "safe-to-deploy"
732 [[exemptions.replace_with]]
734 criteria = "safe-to-deploy"
736 [[exemptions.ringbuf]]
738 criteria = "safe-to-deploy"
742 criteria = "safe-to-deploy"
744 [[exemptions.runloop]]
746 criteria = "safe-to-deploy"
748 [[exemptions.rusqlite]]
750 criteria = "safe-to-deploy"
752 [[exemptions.rust-ini]]
754 criteria = "safe-to-deploy"
756 [[exemptions.rust_decimal]]
758 criteria = "safe-to-deploy"
760 [[exemptions.scroll]]
762 criteria = "safe-to-deploy"
764 [[exemptions.scroll_derive]]
766 criteria = "safe-to-deploy"
768 [[exemptions.self_cell]]
770 criteria = "safe-to-deploy"
772 [[exemptions.serde_with]]
774 criteria = "safe-to-deploy"
776 [[exemptions.serde_with_macros]]
778 criteria = "safe-to-deploy"
782 criteria = "safe-to-deploy"
786 criteria = "safe-to-run"
790 criteria = "safe-to-deploy"
794 criteria = "safe-to-deploy"
796 [[exemptions.signal-hook-registry]]
798 criteria = "safe-to-run"
800 [[exemptions.siphasher]]
802 criteria = "safe-to-deploy"
804 [[exemptions.socket2]]
806 criteria = "safe-to-deploy"
809 version = "0.2.0+1.5.4"
810 criteria = "safe-to-deploy"
812 [[exemptions.stable_deref_trait]]
814 criteria = "safe-to-deploy"
816 [[exemptions.static_assertions]]
818 criteria = "safe-to-deploy"
820 [[exemptions.strsim]]
822 criteria = "safe-to-deploy"
824 [[exemptions.tempfile]]
826 criteria = "safe-to-deploy"
828 [[exemptions.terminal_size]]
830 criteria = "safe-to-deploy"
832 [[exemptions.textwrap]]
834 criteria = "safe-to-deploy"
838 criteria = "safe-to-deploy"
842 criteria = "safe-to-run"
844 [[exemptions.time-macros]]
846 criteria = "safe-to-run"
850 criteria = "safe-to-run"
852 [[exemptions.triple_buffer]]
854 criteria = "safe-to-deploy"
856 [[exemptions.type-map]]
858 criteria = "safe-to-deploy"
860 [[exemptions.typenum]]
862 criteria = "safe-to-deploy"
864 [[exemptions.unix_path]]
866 criteria = "safe-to-run"
868 [[exemptions.unix_str]]
870 criteria = "safe-to-run"
874 criteria = "safe-to-deploy"
878 criteria = "safe-to-deploy"
880 [[exemptions.webrtc-sdp]]
882 criteria = "safe-to-deploy"
884 [[exemptions.winapi]]
886 criteria = "safe-to-deploy"
888 [[exemptions.winapi-i686-pc-windows-gnu]]
890 criteria = "safe-to-deploy"
892 [[exemptions.winapi-x86_64-pc-windows-gnu]]
894 criteria = "safe-to-deploy"
898 criteria = "safe-to-deploy"
900 [[exemptions.xml-rs]]
902 criteria = "safe-to-deploy"
904 [[exemptions.yaml-rust]]
906 criteria = "safe-to-run"
910 criteria = "safe-to-run"