[pre-RFC] Security advisories as part of crates.io metadata

tools and infrastructure cargo
6

I think a binary allow_vulnerable = true is very dangerous. Cargo.toml cannot be modified afterwards and if a new vulnerability is discovered, the dependent crate isn’t necessarily immune against it.

Therefore, I propose to extend this scheme a little bit:

  1. cargo advisory should not be boolean like cargo yank. I should be possible to have multiple advisories per crate.
  2. Every advisory should have a unique identifier (can be internal to cargo or an external one like CVE or DWF).
  3. Dependencies can now be specified as:
[dependencies]
iron = { version = "0.4", allow_vulnerabilities = ["CVE-YYYY-XXXX"] }

EDIT: An automatically generated internal identifier is probably better to prevent collision.

4 Likes