57 lines
2.3 KiB
Markdown
57 lines
2.3 KiB
Markdown
# Dependency maintenance
|
|
|
|
Use the committed Cargo.lock. Do not run broad dependency updates as part of
|
|
unrelated changes. Review runtime compatibility and licensing for each update.
|
|
|
|
## Security audit
|
|
|
|
```bash
|
|
cargo install cargo-audit --locked --version 0.22.0
|
|
cargo audit --json
|
|
```
|
|
|
|
The audit fetches the RustSec advisory database and needs network access. Record
|
|
the tool version and database revision with release evidence. Database download
|
|
failure is not a clean scan. Review informational warnings as well as errors;
|
|
unresolved affected vulnerabilities block release. Cargo auditing does not scan
|
|
Debian packages or fully establish the security of native bundled code.
|
|
|
|
### Reviewed maintenance warning
|
|
|
|
`serde_cbor 0.11.2` has the informational unmaintained advisory
|
|
[RUSTSEC-2021-0127](https://rustsec.org/advisories/RUSTSEC-2021-0127.html).
|
|
It remains used for persisted repository metadata. Replacing it needs a separate
|
|
storage-compatibility review, not an untested codec substitution during release
|
|
cleanup. The warning remains visible in audit output; no advisory is ignored.
|
|
Operators should protect the state directory from untrusted modification.
|
|
|
|
## License notices
|
|
|
|
```bash
|
|
python3 tools/dependency_notices.py --check
|
|
# After a reviewed Cargo.lock change:
|
|
python3 tools/dependency_notices.py
|
|
```
|
|
|
|
Requirements: Python 3, Cargo, curl, and HTTPS access to the Cargo registry and
|
|
GitHub's raw file service. The tool reads the entire locked dependency graph,
|
|
including build-time and other-platform dependencies, and preserves upstream
|
|
license and notice text. `--check` does not modify tracked files.
|
|
|
|
Some package archives omit their license file. `tools/license_supplements.json`
|
|
records exact upstream commit URLs and SHA-256 checksums, derived from the
|
|
package's `.cargo_vcs_info.json`. Version changes need a new source review;
|
|
missing texts or checksum mismatches fail rather than silently omit attribution.
|
|
Do not edit original copyright or license wording to match project formatting.
|
|
|
|
## Coverage
|
|
|
|
With cargo-llvm-cov and the toolchain's llvm-tools-preview component installed:
|
|
|
|
```bash
|
|
cargo llvm-cov --locked --all-targets --json --output-path target/coverage.json
|
|
```
|
|
|
|
Record actual line coverage and tool versions. The release target is 90%.
|
|
Do not exclude production modules or change the denominator to meet the target.
|