chore(deny): group the advisory ignores and record why each one is suppressed - #138
Open
0xrlawrence wants to merge 1 commit into
Open
chore(deny): group the advisory ignores and record why each one is suppressed#1380xrlawrence wants to merge 1 commit into
0xrlawrence wants to merge 1 commit into
Conversation
…ppressed
The ignore list carries 28 entries under two blanket headings ("cannot be
resolved without upgrading polkadot-sdk or ZK crates upstream" and
"Unmaintained"). Several of them are sandbox escapes in the wasmtime engine
that executes the runtime, including RUSTSEC-2026-0091 and RUSTSEC-2026-0092.
Those are probably not reachable from this workspace, but the file does not say
so, and an ignore list that does not record its own reasoning cannot be safely
shortened later: nobody can tell which entries were a considered judgement and
which were added to make CI green.
Regroups the same 28 IDs, unchanged, by the argument that suppresses them:
- Winch backend advisories. Substrate compiles with Cranelift and does not
enable Winch, so these are believed unreachable.
- Component model and WASI advisories. Substrate executes core wasm modules
only and links neither surface.
- Core engine advisories. Neither argument above covers these, so they are
called out as the group to re-read first, particularly on aarch64. The note
also pushes back on the obvious counter-argument, since a chain with runtime
upgrades does not get to treat the runtime as trusted input.
- tracing-subscriber via ark-relations, with the condition that clears it.
- Unmaintained crates, annotated with what pulls each one in.
Adds a preamble stating what a new entry needs (a reason, a clearing
condition, a review date), marks the unverified reasoning as CONFIRM rather
than asserting it, and asks that new entries go in a group instead of being
appended to the end.
The ID set is byte-identical before and after; verified by diffing the parsed
`advisories.ignore` arrays. cargo-deny behaviour is unchanged. I could not run
cargo-deny locally, but the file parses as valid TOML.
I did not add the review dates themselves, since picking them is a decision
for whoever owns this. The natural anchor for the wasmtime group is the next
polkadot-sdk bump.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ignore list in
deny.tomlcarries 28 entries under two blanket headings: "cannot be resolved without upgrading polkadot-sdk or ZK crates upstream" and "Unmaintained". Several are sandbox escapes in the wasmtime engine that executes the runtime, including RUSTSEC-2026-0091 (sandbox-escaping memory access with Winch compiler backend) and RUSTSEC-2026-0092 (miscompiled guest heap access enables sandbox escape on aarch64).Those are probably not reachable from this workspace. The problem is that the file does not say so, and an ignore list that does not record its own reasoning cannot be safely shortened later. Nobody reading it in six months can tell which entries were a considered judgement and which were added to make CI green.
What this changes
The same 28 IDs, regrouped by the argument that actually suppresses them:
Plus a preamble stating what a new entry needs (a reason, a clearing condition, a review date), a
CONFIRMmarker on the reasoning I could not verify against a build, and a request that new entries go in a group rather than being appended to the end.What I deliberately left out
I did not add the review dates. Picking them is a decision for whoever owns this file, and a date I invented would be worse than none. The natural anchor for the wasmtime group is the next polkadot-sdk bump: that group has no upgrade path until then, and every entry in it should be dropped and re-run at that point rather than carried forward by habit.
I also have not verified the Cranelift and component-model reasoning against the build, which is why it is marked
CONFIRMrather than asserted.Verification
The ID set is identical before and after. I diffed the parsed
advisories.ignorearrays to confirm: 28 in, 28 out, nothing added or dropped. cargo-deny behaviour is unchanged; this is comments and ordering. The file parses as valid TOML. I could not run cargo-deny locally.Separately, I have emailed
security@orbinum.netabout a number of higher-severity findings from the same review pass. Those are deliberately not in this PR, in any other PR, or in a public issue.