mirror of
https://github.com/ruvnet/RuView.git
synced 2026-10-22 06:32:35 -05:00
Dan Alec
6d4ca03bb6
The gating "Rust Dependency Audit" job ran cargo audit --file v2/Cargo.lock --json from the repository root. cargo-audit 0.22 resolves its config file as ./.cargo/audit.toml relative to the CURRENT WORKING DIRECTORY, never relative to the --file lockfile it audits, and it has no flag to point at a config path. From the repository root that file does not exist, so the job audited with cargo-audit's defaults and applied NONE of the reviewed ignores in v2/.cargo/audit.toml — every run of the job reports "ignore":[] in its own JSON artifact, which is the machine-readable proof that the policy file was never read. Run the audit inside the v2 workspace so that v2/.cargo/audit.toml is loaded, and record the discovery rule in the file header so the next reader does not move the policy file back out of reach. Also record the three zip advisories, with the reachability proof in the file: RUSTSEC-2026-0367 SUID/SGID bits survive extraction RUSTSEC-2026-0368 extract() creates a symlink pointing outside the destination RUSTSEC-2026-0369 extract() applies permissions through such a symlink All three are fixed only in zip >= 9.0.0, and no published release of the parents moves there — ndarray-npy 0.10.0 -> zip ^6, candle-core 0.11.0 -> zip ^8.6, tch/torch-sys 0.26.0 -> zip ^0.6 — so the bump is not reachable today. They are also not reachable from this workspace. All three live in the extraction path (ZipArchive::extract / ZipStreamReader::extract) and nothing in the resolved graph calls either one: ndarray-npy and candle-core use ZipArchive::new plus by_name / by_index and ZipWriter, and torch-sys extracts the libtorch archive with its own per-entry loop (archive.by_index + fs::File::create + io::copy), so it never calls extract(), never creates a symlink and never applies the archive's Unix permission bits. The single archive it does extract is the pinned libtorch build downloaded over HTTPS from download.pytorch.org. proc-macro-error2 (RUSTSEC-2026-0173) is added next to the existing proc-macro-error entry for the same reason: unmaintained build-time proc-macro, no runtime exposure. Verified: cargo audit --file Cargo.lock from v2/ reports 0 vulnerabilities and exits 0; the policy file now loads 30 documented ignores.