0cccf77faf
- Add tokio-tungstenite 0.24, futures-util 0.3, url 2, base64 0.22 to [workspace.dependencies] (spec §8.1). - Add crates/rutster-tap-echo as 7th workspace member (spec §2). - Transition crates/rutster-tap/Cargo.toml from stub to real manifest with the deps Tasks 2-4 will need (rutster-media, tokio, tokio-tungstenite, serde, serde_json, base64, url, thiserror, tracing). - Skeleton lib.rs (compile test) + main.rs (placeholder fn main) for rutster-tap-echo; Task 5 fills in the echo logic. - Verify cargo deny check passes against the new transitive dep tree. Spec ref: docs/superpowers/specs/2026-06-28-slice-2-agent-tap-design.md §2, §8.1.
142 lines
6.8 KiB
TOML
142 lines
6.8 KiB
TOML
# deny.toml — cargo-deny config (spec §6.1).
|
|
# Run locally: cargo deny check.
|
|
# CI runs `cargo deny check` as the last gate via
|
|
# EmbarkStudios/cargo-deny-action@v1 (ships cargo-deny 0.19.x).
|
|
|
|
[graph]
|
|
# Use Cargo.lock as the source of truth for the dep graph.
|
|
all-features = true
|
|
|
|
[advisories]
|
|
# Vulnerabilities fail CI. cargo-deny ≥ 0.19 always treats advisories as
|
|
# deny (the older `vulnerability = "deny"` lint-level key was removed in
|
|
# https://github.com/EmbarkStudios/cargo-deny/pull/611 — there is no
|
|
# global toggle any more, just the `ignore = [...]` opt-out per RUSTSEC
|
|
# id). The brief's verbatim `deny = ["RUSTSEC-0000-0000"]` sentinel
|
|
# form lands in a later cargo-deny still; we keep the schema here shape
|
|
# that works across 0.18.3, 0.19.9, and the CI action's bundled
|
|
# version — only `version`, `ignore`, and `unmaintained` scope.
|
|
# `unsound` is left at its default scope ("workspace") — same reason
|
|
# as `unmaintained`: stricter would noise on transitive drift we don't
|
|
# control.
|
|
version = 2
|
|
unmaintained = "workspace"
|
|
# Tracked advisories that can't be patched without blocking slice-1's
|
|
# MSRV of 1.85 (rust-toolchain.toml). Each entry MUST link to the
|
|
# advisory, name the blocker, and state when to revisit.
|
|
ignore = [
|
|
# RUSTSEC-2026-0009 — `time` 0.3.41: DoS via stack exhaustion in the
|
|
# RFC 2822 parser when fed deeply-nested, attacker-controlled input.
|
|
# https://rustsec.org/advisories/RUSTSEC-2026-0009
|
|
# Patches landed in `time` 0.3.47 (cap recursion depth) but the
|
|
# `time` 0.3.47+ line requires rustc 1.88, conflicting with the
|
|
# slice-1 MSRV of 1.85 (rust-toolchain.toml; commit 27fb64a pinned
|
|
# `time` to 0.3.41 for exactly this reason). rutster itself never
|
|
# feeds user-controlled input to time's RFC 2822 parser — `time`
|
|
# enters the dep graph only via `rcgen`/`yasna`/`dimpl`/`str0m`
|
|
# internals (cert generation + SCTP handshake timestamps), none of
|
|
# which surface RFC 2822 parsing at the rutster HTTP / media
|
|
# boundary. Net: theoretical stack-exhaustion vector in code we
|
|
# never exercise. Revisit when (a) MSRV lifts past 1.88, or (b)
|
|
# str0m refreshes its `time` dep to a release where the fix landed
|
|
# without MSRV bump.
|
|
"RUSTSEC-2026-0009",
|
|
]
|
|
|
|
[licenses]
|
|
# Allow our own (GPL-3.0-or-later) + the permissive licenses that the
|
|
# Rust ecosystem standardly uses. Confirmed at impl time by running
|
|
# `cargo deny check licenses` (spec §6.1) — this list passes the full
|
|
# str0m/opus/axum transitive graph clean.
|
|
allow = [
|
|
# SPDX expression "GPL-3.0-or-later" is valid SPDX but cargo-deny 0.18.x
|
|
# (the latest that installs on rust 1.85) can't parse the `-or-later`
|
|
# suffix. CI uses `cargo-deny-action@v1` (newer) which parses it; we use
|
|
# the bare `"GPL-3.0"` form so local `cargo deny check` works on the
|
|
# pinned toolchain. ADR-0004's "GPL-3.0-or-later" stance is unchanged;
|
|
# this is a parser workaround. When the workspace MSRV lifts past 1.88
|
|
# (where cargo-deny 0.19.x installs), revert this to `"GPL-3.0-or-later"`.
|
|
"GPL-3.0",
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"Unicode-DFS-2016",
|
|
"Unicode-3.0",
|
|
]
|
|
confidence-threshold = 0.93
|
|
|
|
[bans]
|
|
# Catch accidental dep-tree divergence early: tokio/serde/bytes/tracing
|
|
# each appear exactly once in the graph (spec §6.1).
|
|
multiple-versions = "deny"
|
|
# Slice-1 deviation from the brief's verbatim `deny`: lowered to `warn`
|
|
# because workspace-internal `path = "..."` deps (rutster → rutster-media
|
|
# → rutster-call-model) have no explicit `version =`, which cargo-deny
|
|
# treats as a version wildcard. The canonical fix is to add
|
|
# `version = "<pkg-version>"` on each path dep (Cargo best-practice
|
|
# anyway), but that's a Cargo.toml change outside Task 6's two-file
|
|
# scope (deny.toml + .github/workflows/ci.yml only). Revisit when the
|
|
# workspace crates are first published (or when a later slice touches
|
|
# the workspace manifests for unrelated reasons).
|
|
wildcards = "warn"
|
|
highlight = "all"
|
|
deny = []
|
|
allow = []
|
|
# Skip-list for unavoidable transitive duplicates. Each entry is
|
|
# `name@version` (the version cargo-deny should ignore when checking
|
|
# the `multiple-versions = "deny"` rule). Investigated per cargo-deny's
|
|
# inclusion graph — see each comment.
|
|
skip = [
|
|
# `thiserror` v1 (workspace dep on our own crates) vs v2 (dragged in
|
|
# by `sctp-proto` v0.10 → `str0m` v0.21). Fixable in a later slice by
|
|
# bumping our workspace `thiserror = "1"` to `"2"`; deferred because
|
|
# Task 6 is confined to deny.toml + .github/workflows/ci.yml (no
|
|
# Cargo.toml edits). The `thiserror-impl` proc-macro is tied 1:1 to
|
|
# the `thiserror` version it ships with.
|
|
"thiserror@1.0.69",
|
|
"thiserror-impl@1.0.69",
|
|
# `r-efi` v5.3 vs v6.0 is a transitive split inside str0m's tree:
|
|
# `aws-lc-rs` (via `str0m-aws-lc-rs` via `str0m`) pulls `getrandom`
|
|
# v0.3 → `r-efi` v5.3, while `uuid` v1 (our direct dep) pulls
|
|
# `getrandom` v0.4 → `r-efi` v6.0.
|
|
# Both branches are fully transitive; the only fix would be
|
|
# downgrading uuid's getrandom (impossible) or forking str0m to drop
|
|
# its aws-lc-rs chain (way out of scope for slice 1). Tracked as
|
|
# known transitive cruft until str0m refreshes its crypto deps.
|
|
"r-efi@5.3.0",
|
|
# `getrandom` v0.3 vs v0.4 — same transitive split as `r-efi` above
|
|
# (v0.3 is the aws-lc-rs branch, v0.4 is the uuid branch), tracked
|
|
# together. Both pull distinct `r-efi` versions, so the two skips
|
|
# are coupled: skip one without the other and the dup remains.
|
|
"getrandom@0.3.4",
|
|
# `rand` / `rand_core` / `rand_chacha` / `getrandom` v0.2-era split
|
|
# (slice-2 §8.1 task 1): `tokio-tungstenite` = "0.24" → `tungstenite`
|
|
# 0.24 pulls the OLD `rand` 0.8 chain (rand_core 0.6, rand_chacha 0.3,
|
|
# getrandom 0.2), while `str0m` (via `dimpl`/`sctp-proto`) and the
|
|
# uuid branch use the NEW `rand` 0.9 chain (rand_core 0.9,
|
|
# rand_chacha 0.9, getrandom 0.4). Both branches are fully transitive
|
|
# (we don't depend on `rand` directly). Unified only by either
|
|
# bumping `tokio-tungstenite` to a release that adopts `rand` 0.9
|
|
# (none of the 0.24.x line does; newer 0.25+ requires features beyond
|
|
# slice-2's verbatim dep pin per spec §8.1), or forking tungstenite —
|
|
# both out of scope for Task 1. These four skips are coupled: skip
|
|
# rand@0.8.6 without its three peers and the duplicates remain.
|
|
# Revisit when `tokio-tungstenite` workspace dep moves to a release
|
|
# that unifies on `rand` 0.9.
|
|
"rand@0.8.6",
|
|
"rand_core@0.6.4",
|
|
"rand_chacha@0.3.1",
|
|
"getrandom@0.2.17",
|
|
]
|
|
skip-tree = []
|
|
|
|
[sources]
|
|
# crates.io only. No git deps. Keeps the build reproducible (spec §6.1,
|
|
# PORT_PLAN supply-chain goal).
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
allow-git = []
|