# cargo-vet imports lock
[[unpublished.cranelift]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-bforest]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-bforest]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen-meta]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen-meta]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen-shared]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-codegen-shared]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-control]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-control]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-entity]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-entity]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-frontend]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-frontend]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-interpreter]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-interpreter]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-isle]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-isle]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-jit]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-jit]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-module]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-module]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-native]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-native]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-object]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-object]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-reader]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-reader]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-serde]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-serde]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.cranelift-wasm]]
version = "0.98.0"
audited_as = "0.97.1"
[[unpublished.cranelift-wasm]]
version = "0.99.0"
audited_as = "0.97.1"
[[unpublished.wasi-cap-std-sync]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasi-cap-std-sync]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasi-common]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasi-common]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasi-tokio]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasi-tokio]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-asm-macros]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-asm-macros]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cache]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cache]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cli]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cli]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cli-flags]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cli-flags]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-component-macro]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-component-macro]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-component-util]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-component-util]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cranelift]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cranelift]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cranelift-shared]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-cranelift-shared]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-environ]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-environ]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-explorer]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-explorer]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-fiber]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-fiber]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit-debug]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit-debug]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit-icache-coherence]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-jit-icache-coherence]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-runtime]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-runtime]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-types]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-types]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-crypto]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-crypto]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-http]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-http]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-nn]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-nn]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-threads]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wasi-threads]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wast]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wast]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-winch]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-winch]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wit-bindgen]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wasmtime-wit-bindgen]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle-generate]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle-generate]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle-macro]]
version = "11.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle-macro]]
version = "12.0.0"
audited_as = "10.0.1"
[[unpublished.wiggle-test]]
version = "0.0.0"
audited_as = "0.1.0"
[[unpublished.winch-codegen]]
version = "0.9.0"
audited_as = "0.8.1"
[[unpublished.winch-codegen]]
version = "0.10.0"
audited_as = "0.8.1"
[[publisher.arbitrary]]
version = "1.3.0"
when = "2023-03-13"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.async-trait]]
version = "0.1.53"
when = "2022-03-25"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
wasmtime: Overhaul trampolines (#6262)
This commit splits `VMCallerCheckedFuncRef::func_ptr` into three new function
pointers: `VMCallerCheckedFuncRef::{wasm,array,native}_call`. Each one has a
dedicated calling convention, so callers just choose the version that works for
them. This is as opposed to the previous behavior where we would chain together
many trampolines that converted between calling conventions, sometimes up to
four on the way into Wasm and four more on the way back out. See [0] for
details.
[0] https://github.com/bytecodealliance/rfcs/blob/main/accepted/tail-calls.md#a-review-of-our-existing-trampolines-calling-conventions-and-call-paths
Thanks to @bjorn3 for the initial idea of having multiple function pointers for
different calling conventions.
This is generally a nice ~5-10% speed up to our call benchmarks across the
board: both Wasm-to-host and host-to-Wasm. The one exception is typed calls from
Wasm to the host, which have a minor regression. We hypothesize that this is
because the old hand-written assembly trampolines did not maintain a call frame
and do a tail call, but the new Cranelift-generated trampolines do maintain a
call frame and do a regular call. The regression is only a couple nanoseconds,
which seems well-explained by these differences explain, and ultimately is not a
big deal.
However, this does lead to a ~5% code size regression for compiled modules.
Before, we compiled a trampoline per escaping function's signature and we
deduplicated these trampolines by signature. Now we compile two trampolines per
escaping function: one for if the host calls via the array calling convention
and one for it the host calls via the native calling convention. Additionally,
we compile a trampoline for every type in the module, in case there is a native
calling convention function from the host that we `call_indirect` of that
type. Much of this is in the `.eh_frame` section in the compiled module, because
each of our trampolines needs an entry there. Note that the `.eh_frame` section
is not required for Wasmtime's correctness, and you can disable its generation
to shrink compiled module code size; we just emit it to play nice with external
unwinders and profilers. We believe there are code size gains available for
follow up work to offset this code size regression in the future.
Backing up a bit: the reason each Wasm module needs to provide these
Wasm-to-native trampolines is because `wasmtime::Func::wrap` and friends allow
embedders to create functions even when there is no compiler available, so they
cannot bring their own trampoline. Instead the Wasm module has to supply
it. This in turn means that we need to look up and patch in these Wasm-to-native
trampolines during roughly instantiation time. But instantiation is super hot,
and we don't want to add more passes over imports or any extra work on this
path. So we integrate with `wasmtime::InstancePre` to patch these trampolines in
ahead of time.
Co-Authored-By: Jamey Sharp <jsharp@fastly.com>
Co-Authored-By: Alex Crichton <alex@alexcrichton.com>
prtest:full
2 years ago
[[publisher.bumpalo]]
version = "3.12.0"
when = "2023-01-17"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.clap]]
version = "3.2.8"
when = "2022-06-30"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.clap_derive]]
version = "3.2.7"
when = "2022-06-28"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.clap_lex]]
version = "0.2.4"
when = "2022-06-28"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.cranelift]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-bforest]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen-meta]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen-shared]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-control]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-entity]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-frontend]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-interpreter]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-isle]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-jit]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-module]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-native]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-object]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-reader]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-serde]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-wasm]]
version = "0.97.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.derive_arbitrary]]
version = "1.3.0"
when = "2023-03-13"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.indexmap]]
version = "1.9.1"
when = "2022-06-21"
user-id = 539
user-login = "cuviper"
user-name = "Josh Stone"
[[publisher.itoa]]
version = "1.0.1"
when = "2021-12-12"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.libc]]
version = "0.2.132"
when = "2022-08-16"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.libm]]
version = "0.2.7"
when = "2023-05-15"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.lock_api]]
version = "0.4.7"
when = "2022-03-30"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.parking_lot]]
version = "0.11.2"
when = "2021-08-27"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.parking_lot_core]]
version = "0.8.5"
when = "2021-08-28"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.paste]]
version = "1.0.7"
when = "2022-03-27"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.regalloc2]]
version = "0.9.1"
when = "2023-05-31"
user-id = 187138
user-login = "elliottt"
user-name = "Trevor Elliott"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.ryu]]
version = "1.0.9"
when = "2021-12-12"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.scopeguard]]
version = "1.1.0"
when = "2020-02-16"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
[[publisher.serde]]
version = "1.0.137"
when = "2022-05-01"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.serde_derive]]
version = "1.0.137"
when = "2022-05-01"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.serde_json]]
version = "1.0.80"
when = "2022-04-30"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.syn]]
version = "1.0.92"
when = "2022-04-29"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.syn]]
version = "2.0.16"
when = "2023-05-14"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.thiserror]]
version = "1.0.31"
when = "2022-04-30"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.thiserror-impl]]
version = "1.0.31"
when = "2022-04-30"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.toml]]
version = "0.5.7"
when = "2020-10-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.unicode-segmentation]]
version = "1.10.1"
when = "2023-01-31"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.unicode-width]]
version = "0.1.9"
when = "2021-09-16"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.unicode-xid]]
version = "0.2.3"
when = "2022-05-02"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.wasi-cap-std-sync]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasi-common]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasi-tokio]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasm-encoder]]
version = "0.29.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-metadata]]
version = "0.8.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-mutate]]
version = "0.2.27"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-smith]]
version = "0.12.10"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasmparser]]
version = "0.107.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasmprinter]]
version = "0.2.59"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasmtime]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-asm-macros]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cache]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cli]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cli-flags]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-component-macro]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-component-util]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cranelift]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cranelift-shared]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-environ]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-explorer]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-fiber]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-jit]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-jit-debug]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-jit-icache-coherence]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-runtime]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-types]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-crypto]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-http]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-nn]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-threads]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wast]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-winch]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wit-bindgen]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wast]]
version = "60.0.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wat]]
version = "1.0.66"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wiggle]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wiggle-generate]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wiggle-macro]]
version = "10.0.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wiggle-test]]
version = "0.1.0"
when = "2020-03-12"
user-id = 18162
user-login = "pchickey"
user-name = "Pat Hickey"
[[publisher.winch-codegen]]
version = "0.8.1"
when = "2023-06-21"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.windows-sys]]
version = "0.45.0"
when = "2023-01-21"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows-sys]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows-targets]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows-targets]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_gnullvm]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_gnullvm]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_msvc]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_gnu]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_msvc]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnu]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnullvm]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnullvm]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_msvc]]
version = "0.42.1"
when = "2023-01-12"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.wit-bindgen]]
version = "0.7.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-core]]
version = "0.7.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust]]
version = "0.7.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust-lib]]
version = "0.7.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust-macro]]
version = "0.7.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-component]]
version = "0.11.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-parser]]
version = "0.8.0"
when = "2023-05-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[audits.embark-studios.audits.anyhow]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "1.0.58"
[[audits.embark-studios.audits.cty]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.2.2"
notes = "Inspected it and is a tiny crate with just type definitions"
[[audits.embark-studios.audits.ittapi]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.3.3"
notes = "Lots of unsafe code for calling into C FFI functions, looks pretty simple and sound though. No ambient capabilities"
[[audits.embark-studios.audits.ittapi-sys]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.3.3"
notes = """
Builds C/asm dependency which this review has not audited in detail, but is well established from Intel.
Exposes FFI types & functions generated through bindgen. No other logic.
No ambient capabilities
"""
[[audits.embark-studios.audits.valuable]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.1.0"
notes = "No unsafe usage or ambient capabilities, sane build script"
[[audits.embark-studios.audits.webpki-roots]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.22.4"
notes = "Inspected it to confirm that it only contains data definitions and no runtime code"
[[audits.fermyon.audits.oorandom]]
who = "Radu Matei <radu.matei@fermyon.com>"
criteria = "safe-to-run"
version = "11.1.3"
[[audits.google.audits.fastrand]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "1.9.0"
notes = """
`does-not-implement-crypto` is certified because this crate explicitly says
that the RNG here is not cryptographically secure.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.glob]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "0.3.1"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.libfuzzer-sys]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.4.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.miniz_oxide]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-run"
version = "0.6.2"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.proc-macro-error-attr]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "1.0.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.static_assertions]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "1.1.0"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.version_check]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "0.9.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.isrg.audits.block-buffer]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.9.0"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[audits.isrg.audits.libc]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.139 -> 0.2.141"
[[audits.isrg.audits.once_cell]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.17.1 -> 1.17.2"
[[audits.isrg.audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.17.2 -> 1.18.0"
[[audits.isrg.audits.opaque-debug]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.0"
[[audits.isrg.audits.universal-hash]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.4.1"
[[audits.isrg.audits.untrusted]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.7.1"
[[audits.isrg.audits.wasm-bindgen-shared]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.2.83"
[[audits.mozilla.wildcard-audits.unicode-segmentation]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
user-id = 1139 # Manish Goregaokar (Manishearth)
start = "2019-05-15"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-width]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
user-id = 1139 # Manish Goregaokar (Manishearth)
start = "2019-12-05"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-xid]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
user-id = 1139 # Manish Goregaokar (Manishearth)
start = "2019-07-25"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.57 -> 1.0.61"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
delta = "1.0.58 -> 1.0.57"
notes = "No functional differences, just CI config and docs."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.61 -> 1.0.62"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.62 -> 1.0.68"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.68 -> 1.0.69"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.autocfg]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bit-set]]
who = "Aria Beingessner <a.beingessner@gmail.com>"
criteria = "safe-to-deploy"
version = "0.5.2"
notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bit-vec]]
who = "Aria Beingessner <a.beingessner@gmail.com>"
criteria = "safe-to-deploy"
version = "0.6.3"
notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bitflags]]
who = "Alex Franchuk <afranchuk@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.3.2 -> 2.0.2"
notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bitflags]]
who = "Nicolas Silva <nical@fastmail.com>"
criteria = "safe-to-deploy"
delta = "2.0.2 -> 2.1.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.crypto-common]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.3 -> 0.1.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.debugid]]
who = "Gabriele Svelto <gsvelto@mozilla.com>"
criteria = "safe-to-deploy"
version = "0.8.0"
notes = "This crates was written by Sentry and I've fully audited it as Firefox crash reporting machinery relies on it."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.either]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.6.1"
notes = """
Straightforward crate providing the Either enum and trait implementations with
no unsafe code.
"""
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
[[audits.mozilla.audits.encoding_rs]]
who = "Henri Sivonen <hsivonen@hsivonen.fi>"
criteria = "safe-to-deploy"
version = "0.8.31"
notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.env_logger]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.9.0 -> 0.9.3"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.env_logger]]
who = "Nicolas Silva <nical@fastmail.com>"
criteria = "safe-to-deploy"
delta = "0.9.3 -> 0.10.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.flagset]]
who = "Ryan Hunt <rhunt@eqrion.net>"
criteria = "safe-to-deploy"
version = "0.4.3"
notes = "Uses no ambient capabilities, vetted the one instance of unsafe."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.fnv]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "1.0.7"
notes = "Simple hasher implementation with no unsafe code."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.fxhash]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "0.2.1"
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.6 -> 0.2.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.7 -> 0.2.8"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Yannis Juglaret <yjuglaret@mozilla.com>"
criteria = "safe-to-deploy"
delta = "0.2.8 -> 0.2.9"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.half]]
who = "John M. Schanck <jschanck@mozilla.com>"
criteria = "safe-to-deploy"
version = "1.8.2"
notes = """
This crate contains unsafe code for bitwise casts to/from binary16 floating-point
format. I've reviewed these and found no issues. There are no uses of ambient
capabilities.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.hashbrown]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
version = "0.12.3"
notes = "This version is used in rust's libstd, so effectively we're already trusting it"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.hermit-abi]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.2.6"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.lazy_static]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.4.0"
notes = "I have read over the macros, and audited the unsafe code."
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[audits.mozilla.audits.libc]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.132 -> 0.2.138"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.libc]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.138 -> 0.2.139"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.log]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
version = "0.4.17"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.memoffset]]
who = "Gabriele Svelto <gsvelto@mozilla.com>"
criteria = "safe-to-deploy"
delta = "0.6.5 -> 0.7.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.num-integer]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "0.1.45"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.num-iter]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "0.1.43"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.num-traits]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "0.2.15"
notes = "All code written or reviewed by Josh Stone."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.num_cpus]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.13.1 -> 1.14.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.num_cpus]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.14.0 -> 1.15.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.12.0 -> 1.13.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.13.1 -> 1.16.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.16.0 -> 1.17.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.0.39"
notes = """
`proc-macro2` acts as either a thin(-ish) wrapper around the std-provided
`proc_macro` crate, or as a fallback implementation of the crate, depending on
where it is used.
If using this crate on older versions of rustc (1.56 and earlier), it will
temporarily replace the panic handler while initializing in order to detect if
it is running within a `proc_macro`, which could lead to surprising behaviour.
This should not be an issue for more recent compiler versions, which support
`proc_macro::is_available()`.
The `proc-macro2` crate's fallback behaviour is not identical to the complex
behaviour of the rustc compiler (e.g. it does not perform unicode normalization
for identifiers), however it behaves well enough for its intended use-case
(tests and scripts processing rust code).
`proc-macro2` does not use unsafe code, however exposes one `unsafe` API to
allow bypassing checks in the fallback implementation when constructing
`Literal` using `from_str_unchecked`. This was intended to only be used by the
`quote!` macro, however it has been removed
(https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078),
and is likely completely unused. Even when used, this API shouldn't be able to
cause unsoundness.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.39 -> 1.0.43"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.43 -> 1.0.49"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.49 -> 1.0.51"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.0.57 -> 1.0.59"
notes = "Enabled on Wasm"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
[[audits.mozilla.audits.quote]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.0.18"
notes = """
`quote` is a utility crate used by proc-macros to generate TokenStreams
conveniently from source code. The bulk of the logic is some complex
interlocking `macro_rules!` macros which are used to parse and build the
`TokenStream` within the proc-macro.
This crate contains no unsafe code, and the internal logic, while difficult to
read, is generally straightforward. I have audited the the quote macros, ident
formatter, and runtime logic.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.quote]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.18 -> 1.0.21"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.quote]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.21 -> 1.0.23"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.rayon]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.5.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.rayon-core]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.9.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.rustc-hash]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.similar]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "2.2.0"
notes = """
Algorithm crate implemented entirely in safe rust. Does no platform-specific
logic, only implementing diffing and string manipulation algorithms.
"""
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
wasi-http supply chain audit (#6121)
* add cargo-deny exception for duplicate versions of windows-sys
* cargo vetting for all new deps introduced by https://github.com/bytecodealliance/wasmtime/pull/5929
The audits are straightforward. The exemptions, as always, need to be justified:
* core-foundation, core-foundation-sys, security-framework, security-framework-sys: these are large crates which are FFI bindings to Mac OS frameworks. As such they contain tons of unsafe code to make these FFI calls and manage memory. These crates are too big to audit.
* schannel: same as the above, except this is a windows component, which I'm also unfamiliar with.
* openssl, openssl-sys: also large FFI bindings which are impractical to audit.
* futures-macro, futures-task: while not as complex as futures-util, these are beyond my personal understanding of futures to vet practically. I've asked Alex to look at auditing these, and he will after he returns from vacation next week.
* futures-util: 25kloc of code, over 149 instances of the substring "unsafe" (case insensitive), this is impractical to audit in the extreme.
* h2, http, httparse, hyper, mio, tokio: this so-called tokio/hyper family are very large and challenging to audit. Bobby Holley has indicated that he is working to get the AWS engineers who maintain these crates to publish their own audits, which we can then import. We expect to exempt these until those imports are available.
2 years ago
[[audits.mozilla.audits.slab]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.4.6 -> 0.4.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.socket2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.4.4 -> 0.4.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.synstructure]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "0.12.6"
notes = """
I am the primary author of the `synstructure` crate, and its current
maintainer. The one use of `unsafe` is unnecessary, but documented and
harmless. It will be removed in the next version.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697)
We discussed this in today's Wasmtime meeting and the consensus was that
we trust each of these people to have a sufficient standard of care for
anything they release.
This reduces our estimated audit backlog by about 184 kLOC.
For the most part, the trust records I'm adding here are identical to
trust records that Mozilla is using. The fact that they've also decided
these publishers are trustworthy is reassuring additional evidence for
our decision. The exceptions and notable cases are as follows:
I've chosen to not trust three crates by these authors that Mozilla did
not trust. I suspect Mozilla simply doesn't use these crates or has
manually audited them, rather than there being any problem with the
crates themselves. But I've chosen to be conservative about what we
trust.
- autocfg: we only have an exception for an old version, and that
version is only used transitively by wasi-crypto.
- env_logger: Mozilla has audited some versions; we should update, or
add delta audits.
- thread_local: only used by tracing-subscriber which is only used in
dev-dependencies.
I've trusted one crate that Mozilla did not: libm, when published by
Amanieu. We're trusting libc when published by the same author, and libm
is a small extension of the same trust.
Recent versions of the toml crate have been published by epage so I
looked at in this process, but Mozilla only trusts the older versions
which were published by alexcrichton. They've been delta-auditing the
newer versions. I've chosen to follow their lead on this; Alex is a
trusted contributor to Wasmtime anyway.
1 year ago
[[audits.mozilla.audits.toml]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
delta = "0.5.7 -> 0.5.9"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.unicode-normalization]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.1.20"
notes = "I am the author of most of these changes upstream, and prepared the release myself, at which point I looked at the other changes since 0.1.19."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.unicode-normalization]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.20 -> 0.1.21"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
