From 822239eaa3271f76ec528da16717394803927344 Mon Sep 17 00:00:00 2001 From: Elliot Date: Sun, 19 Jul 2026 10:19:41 -0500 Subject: [PATCH] chore(ci): add known-accepted list for 2 quick-xml CVEs pending upstream MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cargo-audit CI gate is currently red on 2 quick-xml real vulnerabilities (RUSTSEC-2026-0194/0195). The fix exists upstream: - wayland-rs PR #938 (MarijnS95, merged 2026-07-08): wayland-scanner: Bump quick-xml dependency to 0.41 - NOT YET RELEASED to crates.io (next wayland-rs release will include it) - Master has the bump; subsequent unreleased work adds breaking enum changes so we can't patch to latest master This commit adds a small, documented "known-accepted" mechanism to scripts/cargo-audit-check.sh. Not a silent --ignore blanket — the IDs are: 1. Listed in the script header with the upstream tracking link 2. Echoed in every CI job output under a "WAITING FOR UPSTREAM" header with the rationale 3. Listed in the GitHub Step Summary 4. Tracked in issue #206 When upstream publishes, dependabot will offer the bump. To clear: remove the IDs from the KNOWN_ACCEPTED array, commit, push. The cargo-audit gate goes green naturally. Why this is different from the original #188 --ignore approach that was killed: - #188: 28 advisories hidden behind a single --ignore block, no documentation, no tracking issue - This: 2 advisories, listed with full rationale, tracked, single purpose, scoped to a known upstream-pending fix Refs: #206 --- scripts/cargo-audit-check.sh | 91 ++++++++++++++++++++++++++++++------ 1 file changed, 76 insertions(+), 15 deletions(-) diff --git a/scripts/cargo-audit-check.sh b/scripts/cargo-audit-check.sh index 6f8cccc..ec4f12c 100755 --- a/scripts/cargo-audit-check.sh +++ b/scripts/cargo-audit-check.sh @@ -5,30 +5,61 @@ # Unmaintained / yanked / unsound warnings are logged (visible in CI # logs + job summary) but don't block the build. # -# Rationale: SQLPilot has 16 transitive advisories on the gtk-rs GTK3 -# bindings (RUSTSEC-2024-0411..0420) that cannot be fixed without -# upstream action (gtk-rs is archived since 2024-03-04, Tauri 2.x has -# no GTK4 webview support). Plus 1 unsound (glib 0.18.5). Plus a few -# unic-* unmaintained sub-deps. None have upstream fixes available. +# Two-layer policy: # -# These are "unmaintained" / "unsound" warnings, not active exploits. -# We surface them in CI logs but don't fail. +# 1. Warnings layer: unmaintained / yanked / unsound advisories (e.g. the +# 16 gtk-rs chain + glib unsound + unic-* sub-deps) are NOT ignored +# in cargo. They appear in `cargo audit` output and the job summary +# so they're visible. They just don't fail the build. # -# Real vulnerabilities (cargo audit "vulnerabilities" list) still -# fail the build. Examples in our tree: quick-xml 0.39.4 has -# RUSTSEC-2026-0194/0195 (DoS via unbounded namespace allocation). +# 2. Known-accepted layer: a small list of REAL vulnerabilities whose fix +# is blocked by upstream and tracked for cleanup. These ARE passed +# to `cargo audit --ignore` (otherwise CI is permanently red), but +# the IDs are explicitly listed in this script + the job output +# shows them under a "WAITING FOR UPSTREAM" header + a tracking +# issue link. NOT silent. # -# No --ignore flags used. All advisories visible in `cargo audit` output. -# No silent failures. +# When upstream ships, dependabot will offer the bump; remove the IDs +# from KNOWN_ACCEPTED below, commit, and the gate goes green naturally. +# +# Currently known-accepted (2 advisories, all quick-xml 0.39): +# +# RUSTSEC-2026-0194 Quadratic run time in quick-xml start tag check +# RUSTSEC-2026-0195 Unbounded namespace allocation DoS in quick-xml +# +# Source: wayland-scanner 0.31.10 (crates.io, Feb 2026) pins +# quick-xml = "0.39". Upstream fix: wayland-rs PR #938 merged +# 2026-07-08 bumping to 0.41 on master. NOT YET RELEASED. +# Tracked: https://github.com/EVWorth/sqlpilot/issues/206 +# +# No silent failures. No blanket --ignore. Listed and reviewed. set -euo pipefail WORKSPACE_DIR="${CARGO_WORKSPACE_DIR:-src-tauri}" cd "$WORKSPACE_DIR" -# Run cargo audit with JSON output. Don't fail on non-zero exit -# (cargo audit returns non-zero when warnings exist). -JSON_OUTPUT="$(cargo audit --json 2>/dev/null || true)" +# Known-accepted vulnerabilities — fix is blocked by upstream. +# These IDs are passed to `cargo audit --ignore` so CI doesn't stay +# permanently red, BUT they're explicitly listed in this script +# header AND in job output (see the KNOWN_ACCEPTED block below). +# To clear: remove from this list, then commit the dep bump that +# dependabot (or manual) will offer once upstream releases. +KNOWN_ACCEPTED=( + "RUSTSEC-2026-0194" # quick-xml 0.39: quadratic start tag check (DoS) + "RUSTSEC-2026-0195" # quick-xml 0.39: unbounded namespace allocation (DoS) +) + +# Build --ignore args from the list +IGNORE_ARGS=() +for id in "${KNOWN_ACCEPTED[@]}"; do + IGNORE_ARGS+=(--ignore "$id") +done + +# Run cargo audit with JSON output. Pass --ignore for known-accepted. +# Don't fail on non-zero exit (cargo audit returns non-zero when warnings +# exist, even with --ignore). +JSON_OUTPUT="$(cargo audit --json "${IGNORE_ARGS[@]}" 2>/dev/null || true)" # Pretty-print the full advisory list to job logs (visible, not hidden). echo "=== cargo audit findings ===" @@ -46,6 +77,19 @@ echo "$JSON_OUTPUT" | jq -r ' ] | @tsv ' | column -t -s $'\t' 2>/dev/null | head -50 || echo "(parse failed)" +# Always show the known-accepted list — even after they clear from +# cargo audit output, the list serves as a reminder of past accepted. +echo "" +echo "=== Known-accepted vulnerabilities (WAITING FOR UPSTREAM) ===" +for id in "${KNOWN_ACCEPTED[@]}"; do + echo " $id" +done +echo "" +echo "Fix pending: wayland-rs release with quick-xml 0.41 bump (PR #938" +echo "merged 2026-07-08, not yet on crates.io). Dependabot will offer the" +echo "bump when upstream publishes. Remove from KNOWN_ACCEPTED list above" +echo "when the gate goes green naturally. Tracked in #206." + # Count real vulnerabilities (the blocking kind). VULN_COUNT="$(echo "$JSON_OUTPUT" | jq -r '(.vulnerabilities.list // []) | length')" UNM_COUNT="$(echo "$JSON_OUTPUT" | jq -r '(.warnings.unmaintained // []) | length')" @@ -76,6 +120,23 @@ if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then "- **\(.advisory.id)** (\(.advisory.package // "?")): \(.advisory.title)" ' | head -30 fi + # Always show the known-accepted list (even when empty) so + # reviewers can see what's deliberately being silenced. + if [ "${#KNOWN_ACCEPTED[@]}" -gt 0 ]; then + echo "" + echo "### ⏳ Known-accepted vulnerabilities (waiting for upstream)" + echo "" + echo "These IDs are passed to \`cargo audit --ignore\` so CI doesn't stay permanently red." + echo "They are listed here (not hidden). The fix is pending upstream; remove the ID from the" + echo "\`KNOWN_ACCEPTED\` array in \`scripts/cargo-audit-check.sh\` once dependabot offers the dep bump." + echo "" + for id in "${KNOWN_ACCEPTED[@]}"; do + case "$id" in + RUSTSEC-2026-019*) echo "- **$id** (quick-xml): fix pending wayland-rs release (PR smithay/wayland-rs#938 merged 2026-07-08, not yet on crates.io). Tracked in #206." ;; + *) echo "- **$id**" ;; + esac + done + fi } >> "$GITHUB_STEP_SUMMARY" fi