Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

audit.toml: Add Marvin Attack from rsa crate to ignore list #134

Merged
merged 1 commit into from
Dec 1, 2023
Merged

audit.toml: Add Marvin Attack from rsa crate to ignore list #134

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[advisories]
ignore = [
"RUSTSEC-2023-0071", # `rsa` Marvin Attack not concerning as `rsa` is only used for tests
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if we suddenly use it elsewhere (not in tests) ? Can we ignore it only for certain files?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As this is an FFI layer for PSA, I can't think of a situation where we would provide an RSA operation from "rsa" crate here. Any particular situation you can think of?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not really, but I do think this may be useful for other situations.
If you prefer not to add it in this one, we can keep in mind for future parallaxsecond PRs, as I'm sure a case in which this would apply will happen later.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it might happen in other repos. I'm unaware if there is an option to restrict audit ignores to specific files. Let me have a look.

]
Loading