rust-supply-chain

Rust Supply Chain

An audit that ends in a list of advisory IDs has done the easy half. The hard half is saying, per advisory, whether this repo actually reaches the vulnerable code path and what to do about it.

What this covers, and the one rule

Four questions: is anything we depend on known-vulnerable, is anything unmaintained, does every licence in the tree comply with the policy, and is the tree carrying weight it does not need. Read Cargo.lock as the authority on what is actually built — not Cargo.toml, which states ranges — and read the MSRV from docs/agents/rust.md, because a fix that bumps a dependency past the MSRV is not a fix. The rule: every finding ends in a decision — upgrade, replace, vendor, or accept with a written reason and an expiry. An unactioned advisory list is noise, and noise trains people to ignore the tool.

Two tools, overlapping on purpose

cargo audit reads the RustSec advisory database and answers exactly one question: is anything in the tree known-vulnerable. cargo deny answers four — advisories, bans, licenses, sources — including that same one, against a policy file; with no deny.toml it runs on built-in defaults that encode no policy. A repo running cargo deny check does not need cargo audit separately; a repo that wants only advisory checking and no policy file is better off with cargo audit alone. Say which the repo should run and why, rather than adding both. The policy file in full, annotated, is in DENY.md; it lands in the target repo only on explicit request.

Reading an advisory properly

An ID and a severity are the start. The question is whether this repo reaches the affected code — a parsing vulnerability in a crate used only in a build script for developer tooling is a different decision from the same advisory in a network-facing path. The mechanics: cargo tree --invert <crate> shows who pulled it in, which tells you whether the dependency is direct (you upgrade) or transitive (you upgrade the intermediary, or wait for it). State plainly that "no upstream fix yet" is a real outcome with real options — pin, patch via [patch.crates-io], vendor, or replace — and that recording the choice matters more than which one is picked.