Skip to content

Commit

Permalink
Add additional trusted crate publishers
Browse files Browse the repository at this point in the history
  • Loading branch information
repi committed Jun 21, 2023
1 parent 9e20dba commit 8530b76
Show file tree
Hide file tree
Showing 2 changed files with 93 additions and 96 deletions.
24 changes: 24 additions & 0 deletions supply-chain/config.toml
Original file line number Diff line number Diff line change
Expand Up @@ -722,6 +722,30 @@ criteria = "safe-to-deploy"
version = "0.4.0"
criteria = "safe-to-deploy"

[[exemptions.windows-targets]]
version = "0.42.1"
criteria = "safe-to-deploy"

[[exemptions.windows-targets]]
version = "0.48.0"
criteria = "safe-to-deploy"

[[exemptions.windows_aarch64_gnullvm]]
version = "0.42.0"
criteria = "safe-to-deploy"

[[exemptions.windows_aarch64_gnullvm]]
version = "0.48.0"
criteria = "safe-to-deploy"

[[exemptions.windows_x86_64_gnullvm]]
version = "0.42.0"
criteria = "safe-to-deploy"

[[exemptions.windows_x86_64_gnullvm]]
version = "0.48.0"
criteria = "safe-to-deploy"

[[exemptions.winit]]
version = "0.27.5"
criteria = "safe-to-run"
Expand Down
165 changes: 69 additions & 96 deletions supply-chain/imports.lock
Original file line number Diff line number Diff line change
Expand Up @@ -371,6 +371,20 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows-sys]]
version = "0.45.0"
when = "2023-01-21"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows-sys]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_aarch64_msvc]]
version = "0.36.1"
when = "2022-04-27"
Expand All @@ -392,6 +406,13 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_aarch64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_i686_gnu]]
version = "0.36.1"
when = "2022-04-27"
Expand All @@ -413,6 +434,13 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_i686_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_i686_msvc]]
version = "0.36.1"
when = "2022-04-27"
Expand All @@ -434,6 +462,13 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_i686_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_x86_64_gnu]]
version = "0.36.1"
when = "2022-04-27"
Expand All @@ -455,6 +490,13 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_x86_64_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_x86_64_msvc]]
version = "0.36.1"
when = "2022-04-27"
Expand All @@ -476,6 +518,13 @@ user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.windows_x86_64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"

[[publisher.winnow]]
version = "0.4.6"
when = "2023-05-02"
Expand Down Expand Up @@ -1280,102 +1329,6 @@ criteria = "safe-to-deploy"
delta = "2.3.2 -> 2.3.3"
notes = "No significant changes: minor refactoring and removes the need to use `winapi`."

[[audits.wasmtime.audits.windows-sys]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.42.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows-sys]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows-sys]]
who = "Pat Hickey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.0 -> 0.45.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows-targets]]
who = "Pat Hickey <[email protected]>"
criteria = "safe-to-deploy"
version = "0.42.1"
notes = "This is a Windows API bindings library maintained by Microsoft themselves. Additionally, this particular crate is empty and just collects a bunch of dependencies, which are not exported, so I don't understand why it exists at all."

[[audits.wasmtime.audits.windows-targets]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves. It just provides the import libs needed by windows-sys."

[[audits.wasmtime.audits.windows_aarch64_gnullvm]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.42.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_aarch64_gnullvm]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_aarch64_gnullvm]]
who = "Pat Hickey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.0 -> 0.42.1"
notes = "This is a Windows API bindings library maintained by Microsoft themselves. The diff is just adding license files."

[[audits.wasmtime.audits.windows_aarch64_msvc]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_i686_gnu]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_i686_msvc]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_x86_64_gnu]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_x86_64_gnullvm]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.42.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_x86_64_gnullvm]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.wasmtime.audits.windows_x86_64_gnullvm]]
who = "Pat Hickey <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.0 -> 0.42.1"
notes = "This is a Windows API bindings library maintained by Microsoft themselves. The diff is just adding license files."

[[audits.wasmtime.audits.windows_x86_64_msvc]]
who = "Dan Gohman <[email protected]>"
criteria = "safe-to-deploy"
version = "0.48.0"
notes = "This is a Windows API bindings library maintained by Microsoft themselves."

[[audits.zcash.audits.arrayref]]
who = "Sean Bowe <[email protected]>"
criteria = "safe-to-deploy"
Expand Down Expand Up @@ -1445,13 +1398,33 @@ criteria = "safe-to-deploy"
delta = "0.42.1 -> 0.42.2"
aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"

[[audits.zcash.audits.windows_aarch64_gnullvm]]
who = "Jack Grigg <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.0 -> 0.42.1"
notes = """
This is a Windows API bindings library maintained by Microsoft themselves.
Changes are to a bundled binary library; it looks like these were accidentally left out of 0.42.0.
"""
aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"

[[audits.zcash.audits.windows_aarch64_gnullvm]]
who = "Jack Grigg <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.1 -> 0.42.2"
notes = "This is an opaque Windows API bindings library maintained by Microsoft."
aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"

[[audits.zcash.audits.windows_x86_64_gnullvm]]
who = "Jack Grigg <[email protected]>"
criteria = "safe-to-deploy"
delta = "0.42.0 -> 0.42.1"
notes = """
This is a Windows API bindings library maintained by Microsoft themselves.
Changes are to a bundled binary library; it looks like these were accidentally left out of 0.42.0.
"""
aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"

[[audits.zcash.audits.windows_x86_64_gnullvm]]
who = "Jack Grigg <[email protected]>"
criteria = "safe-to-deploy"
Expand Down

0 comments on commit 8530b76

Please sign in to comment.