Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Add cargo-vet configuration to require audits of dependencies#41353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Draft
jschwe wants to merge1 commit intoservo:main
base:main
Choose a base branch
Loading
fromjschwe:jschwender/cargo-vet

Conversation

@jschwe
Copy link
Member

@jschwejschwe commentedDec 17, 2025•
edited
Loading

This adds CI testing using cargo vet to audit dependencies
Seehttps://mozilla.github.io/cargo-vet/index.html for detailed documentation.

The initial policy is to trust audits performed by the following organizations:

Implications

This would mean that for every depedency update, it would either have to be verified by an audit performed by us or another org we trust. Alternatively, we can mark publishers / crates as trusted (for example for first-party crates maintained by the servo org).

Testing:Describe how this pull request is tested or why it doesn't require tests
Fixes:#34374

Signed-off-by: Jonathan Schwender <schwenderjonathan@gmail.com>
@atouchet
Copy link
Contributor

Does cargo-vet work with the Dependabot workflow at all? I can imagine that if we both automatically attempt to merge new dependency updates but also require dependencies to be audited that the result will be a large number of Dependabot PRs failing CI checks.

@jschwe
Copy link
MemberAuthor

Does cargo-vet work with the Dependabot workflow at all?

If the new dependency is audited, either by

  1. a wildcard audit entry (trusted publisher)
  2. someone else that we trust already audited the new version.

So yes, rhis will definitely influence the dependabot workflow, but then again that is half the point. We will need to tune this, and I'm not sure how configurable dependabot is yet, but if dependabot PRs first ran cargo vet, before anything else, then it wouldn't waste much resources.

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@sagudevsagudevAwaiting requested review from sagudevsagudev will be requested when the pull request is marked ready for reviewsagudev is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Start using cargo-vet

2 participants

@jschwe@atouchet
[8]ページ先頭
©2009-2025 Movatter.jp