open-standards/scripts/check-advisories.py

#!/usr/bin/env python3
#
# check-advisories.py — no workspace carries a security advisory nobody has read.
#
# This tree holds many workspaces, and a vulnerable crate usually arrives
# transitively, in a lockfile nobody edited, for a reason nobody chose. Without
# a gate the backlog only grows, and it grew: a sweep in October 2026 found 142
# vulnerability instances across 47 lockfiles, among them a WASM runtime with a
# filesystem sandbox escape in the one component whose job is confinement.
# Nothing had failed, because nothing was looking.
#
# For every tracked Cargo.lock this runs
#
#     cargo audit --file <lock> --json
#
# and fails on any advisory that is not in ALLOW below. It reads the advisory
# database and the lockfile; it builds nothing.
#
# ALLOW is the whole point. An advisory may be left in place — upstream has no
# fixed release, or the vulnerable call is unreachable here — but only in
# writing, with the reason next to the id. Two rules keep that honest:
#
#   * an advisory that is not listed fails the run, so a new one has to be
#     looked at rather than accumulated;
#   * a listed advisory that no longer appears anywhere ALSO fails the run, so
#     an entry cannot outlive the exposure it excused. An allow list that is
#     never pruned stops describing the tree and starts hiding it.
#
# Warnings (unmaintained, unsound, yanked) are counted and printed but do not
# fail the run, and the count is printed so the number stays visible rather
# than unknown. For `unmaintained` that is easy: it is advice about a crate's
# future, not a reachable defect.
#
# `unsound` and `yanked` deserve a straighter answer, because neither is mere
# maintenance advice and both have been worth acting on:
#
#   * unsound-with-a-fix is a real defect a bump would close — one of them was
#     a use-after-free in `LruCache::pop()`. It is not gated **today** only
#     because every current instance is either pinned by a dependent
#     (zstd-safe under wasmtime 49's module cache, which nothing here
#     configures) or needs a semver-major move of a transitive crate (lru,
#     rand, glib). A gate that is red for things nobody can act on teaches
#     people to bypass it, which costs more than it catches. Gate it once
#     those can actually move.
#   * yanked means the author withdrew a release, which can happen to a
#     version that was correct when it was chosen: `crypto-bigint 0.7.6` was
#     picked here to fix RUSTSEC-2026-0387 and was yanked afterwards, along
#     with every 0.7.x below 0.7.9. Gating it would turn every PR red for a
#     decision made outside the tree, so it stays a warning — but it is worth
#     re-reading after any advisory work, which is how that one was caught.
#
# Both are therefore a standing review item, not an oversight.
#
#   check-advisories.py                  every tracked Cargo.lock, less SKIP
#   check-advisories.py DIR ...          exactly these directories
#   check-advisories.py --from-json F... audit JSON already captured (self-test)
#
# Exit 0: every advisory found is allowed, and every allowed advisory was found.
# Exit 1: otherwise — including when a lockfile could not be audited at all,
# which is reported under its own heading so an error is never read as "clean".
import json
import os
import subprocess
import sys

# Advisories left in place on purpose. Each needs the reason, and each must
# still be reported by at least one lockfile or this check fails.
#
# An entry is either
#
#     "RUSTSEC-...": "why it can be left"
#
# which excuses the advisory at ANY version — correct when the reason does not
# depend on the version, such as a call we never make — or
#
#     "RUSTSEC-...": {"why": "...", "only": ("crate 1.2.3", ...)}
#
# which excuses it ONLY at those exact crate/version pairs. Use the second form
# whenever the reason is "this particular line cannot move yet", because the
# first form is version-blind: it would go on excusing the advisory if a
# patched line later regressed to an unpatched release. Every pair named in
# `only` must also still appear, or the entry is stale and the run fails.
ALLOW = {
    # ── Unreachable here ────────────────────────────────────────────────────
    # All three are faults in `extract()`: SUID/SGID bits preserved from the
    # archive, symlinks whose targets escape the destination, and permissions
    # applied through those symlinks. Nothing that runs in this tree extracts an
    # archive, and no crate here calls zip directly. The one call left in the
    # graph is a build script's, on its own download; RUSTSEC-2026-0429 below
    # names it.
    "RUSTSEC-2026-0367": "zip: extract-only; nothing here that runs extracts an archive",
    "RUSTSEC-2026-0368": "zip: extract-only; nothing here that runs extracts an archive",
    "RUSTSEC-2026-0369": "zip: extract-only; nothing here that runs extracts an archive",
    "RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here that runs extracts",
    # `ZipArchive::extract` sizes a symlink target's buffer from the size the
    # archive declares, so a 112-byte archive aborts the process. Fixed in 9.0.0,
    # which wai-rs and wai-quantum-desktop take. The copies left, by call site:
    #
    #   aac-rs, 8.6.0: open_board_format 0.1.1 is its newest release and asks for
    #     ^8.6. It unpacks a board with `by_index` and `read_to_end`.
    #   jouleclaw-rs, 1.1.4, and openpay, 1.3.1: candle-core 0.8.4 reads npz and
    #     pth weights by name. burn 0.17 holds openpay's copy there.
    #   jouledesk-rs, 0.6.6: webrtc-sys-build 0.3.18 does call `extract`, in a
    #     build script, on the libwebrtc archive it downloads itself. The worst
    #     this does is abort a build. The crate's next releases change which
    #     libwebrtc it downloads, so it moves with livekit, not alone.
    #
    # Version-pinned, so a copy at any other version fails the run and is read.
    "RUSTSEC-2026-0429": {
        "why": "zip: extract-only abort; three copies never extract, the fourth is a build script on its own download",
        "only": ("zip 8.6.0", "zip 1.1.4", "zip 1.3.1", "zip 0.6.6"),
    },
    # The Marvin attack recovers an RSA key from the timing of **private-key
    # decryption** (PKCS#1 v1.5). There is no fixed release of `rsa` at all, so
    # this one cannot be bumped away and the reason has to carry it. Both
    # remaining copies were checked by call site, not by assumption:
    #
    #   sandbox-rs: `sandbox-tee/src/amd_kds.rs` is the only direct user in the
    #     tree. It verifies AMD's KDS chain (ARK -> ASK -> VCEK, RSASSA-PSS /
    #     SHA-384) with `RsaPublicKey` + `pss::VerifyingKey` + `Verifier`.
    #     Public-key verification only; there is no decryption anywhere, and
    #     `RsaPrivateKey` appears solely inside `#[cfg(test)] mod tests`, which
    #     mints throwaway keys to build a synthetic chain.
    #   wai-rs: reaches it only through `c2pa`, which is an optional dependency
    #     behind the `c2pa_emit` feature and off by default, so a default build
    #     does not compile it. WAI's own signing is Ed25519 (`ed25519_dalek`),
    #     which uses neither `rsa` nor `crypto-bigint`.
    #
    # openpay's copy is gone: the dependency was declared and never used, so it
    # was removed outright rather than excused.
    "RUSTSEC-2023-0071": "rsa: no fixed release; verification only, no decryption, private keys test-only",
    # ── Pinned by a dependency; needs an upstream release ──────────────────
    # zstd's four October 2026 advisories (a stream's data leaking into the
    # next on a reused context; Seekable::decompress past the end; uninitialised
    # memory from a failed legacy-frame stream; the wasm allocator shim). Every
    # direct use here moved to zstd 0.14.3 / zstd-safe 8.2.0 / zstd-sys 2.1.2.
    # The one copy left is wasmtime 49's: wasmtime-internal-cache compresses
    # compiled modules for wasmtime's on-disk cache, and sandbox-exec-wasm
    # builds its engine from Config::new() with fuel metering only and never
    # configures a cache, so none of zstd's code runs in the sandbox. Pinned to
    # those exact versions: a direct use regressing to them is not excused.
    "RUSTSEC-2026-0391": {
        "why": "zstd 0.13.3 only in wasmtime 49's module cache, which the sandbox never configures",
        "only": ("zstd 0.13.3",),
    },
    "RUSTSEC-2026-0398": {
        "why": "zstd-safe 7.2.4 only under wasmtime 49's module cache, which the sandbox never configures",
        "only": ("zstd-safe 7.2.4",),
    },
    "RUSTSEC-2026-0403": {
        "why": "zstd-safe 7.2.4 only under wasmtime 49's module cache, which the sandbox never configures",
        "only": ("zstd-safe 7.2.4",),
    },
    "RUSTSEC-2026-0410": {
        "why": "zstd-sys 2.0.16 only under wasmtime 49's module cache, never configured, and native: the shim is wasm's",
        "only": ("zstd-sys 2.0.16+zstd.1.5.7",),
    },
    # Secret-dependent branches in operations meant to be constant-time
    # (subtraction, zero counting, division, Montgomery multiplication), so
    # timing can leak intermediate arithmetic on a secret integer. Fixed in
    # >=0.7.6, and smart-byte's 0.7.x copy is patched.
    #
    # Every remaining 0.5.5 copy arrives under `elliptic-curve` — it is the only
    # dependent in all five lockfiles — which pins the 0.5 line, so reaching
    # >=0.7.6 means moving the whole p256/elliptic-curve stack. That is an
    # upgrade, not a bump, and this entry is that debt.
    #
    # What bounds it: a timing attack of this class recovers a key by observing
    # many operations under the *same* secret, and none of our own signing runs
    # through this crate. WAI, sandbox and jouleclaw sign with Ed25519
    # (`ed25519_dalek` / curve25519-dalek, which does not use crypto-bigint),
    # and wai-rs holds no 0.5.5 copy since `c2pa` 0.91 took elliptic-curve 0.14.
    # So the debt is real but it is not sitting under a long-lived key of ours.
    #
    # Version-pinned on purpose: a 0.7.x copy must never be excused by it.
    "RUSTSEC-2026-0387": {
        "why": "crypto-bigint 0.5.5 pinned by elliptic-curve 0.13; our signing is Ed25519; 0.7.x is patched",
        "only": ("crypto-bigint 0.5.5",),
    },
    # hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are
    # panics on short or malformed hybrid keys — denial of service, not memory
    # corruption. Fixed by an openmls/hpke-rs release, not from here.
    "RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
    "RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
    # quick-xml is 0.41 everywhere the version is ours to choose, which includes
    # every call that actually parses: op-iso20022's codec binds the workspace
    # 0.41. Two older copies remain in the graph, neither on a parse path.
    #   openpay resolves 0.37.5 through open-payments-iso20022 1.0.10, which
    #   declares quick-xml but never calls it — the crate ships serde-annotated
    #   ISO 20022 types (3 files, ~2.2k lines, no `quick_xml` reference), and
    #   the parsing is ours. Compiled, never executed.
    #   smart-byte resolves 0.39.4 through plist -> netdev -> netwatch -> iroh,
    #   which parses macOS plists, not counterparty XML.
    # -0195 additionally needs `NsReader`, which appears nowhere in this tree.
    "RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: not on a parse path; our parsing is on 0.41",
    "RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused, and neither copy parses",
    # h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive;
    # the fix is a major move for the dependent.
    "RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent",
    # hickory-proto 0.25.2 under smart-byte via iroh. -0118 has no fixed
    # release; -0119 needs 0.26, which iroh does not take yet.
    "RUSTSEC-2026-0118": "hickory-proto: no fixed release; transitive under iroh",
    "RUSTSEC-2026-0119": "hickory-proto: 0.26 not taken by iroh yet",
    # pyo3 0.28.3 under eoc-rs. Both need 0.29, a breaking move for the binding.
    "RUSTSEC-2026-0176": "pyo3: 0.29 is a breaking move for the binding",
    "RUSTSEC-2026-0177": "pyo3: 0.29 is a breaking move for the binding",
}

# Lockfiles cargo does not read: a vendored crate's own lock, kept with the
# vendored source. Each must still exist, or the entry is stale.
SKIP = (
    "jouledesk/jouledesk-rs/vendor/libwebrtc",
    "joule-code/joule-code-rs/vendor/wtransport",
)


def discover():
    root = subprocess.run(
        ["git", "rev-parse", "--show-toplevel"], capture_output=True, text=True
    ).stdout.strip()
    if not root:
        sys.exit("check-advisories: not in a git checkout.")
    os.chdir(root)
    for d in SKIP:
        if not os.path.isfile(os.path.join(d, "Cargo.lock")):
            sys.exit(
                f"check-advisories: the skip list names {d}, which holds no "
                "Cargo.lock. Remove the entry."
            )
    out = subprocess.run(["git", "ls-files"], capture_output=True, text=True).stdout
    locks = [
        p
        for p in out.splitlines()
        if p == "Cargo.lock" or p.endswith("/Cargo.lock")
        if os.path.dirname(p) not in SKIP
    ]
    return sorted(locks)


def audit(lock):
    """Return (parsed_json, error_text). Exactly one is None."""
    try:
        p = subprocess.run(
            ["cargo", "audit", "--file", lock, "--json", "--color", "never"],
            capture_output=True,
            text=True,
            timeout=600,
        )
    except FileNotFoundError:
        return None, "cargo is not on PATH"
    except subprocess.TimeoutExpired:
        return None, "cargo audit timed out"
    # cargo audit exits non-zero when it finds something, so the exit status is
    # not the signal; absence of parseable JSON is.
    try:
        return json.loads(p.stdout), None
    except json.JSONDecodeError:
        tail = (p.stderr or p.stdout or "").strip().splitlines()
        return None, "; ".join(tail[-3:]) or "no JSON on stdout"


def main():
    args = sys.argv[1:]
    from_json = False
    if args and args[0] == "--from-json":
        from_json, args = True, args[1:]

    if from_json:
        sources = [(f, None) for f in args]
    elif args:
        sources = [(os.path.join(d, "Cargo.lock"), None) for d in args]
    else:
        sources = [(l, None) for l in discover()]
    if not sources:
        sys.exit("check-advisories: found no Cargo.lock to check.")

    found = {}       # id -> [(crate, version, lock)]
    unchecked = []   # (lock, why)
    warn_count = 0

    for lock, _ in sources:
        if from_json:
            try:
                with open(lock) as fh:
                    data, err = json.load(fh), None
            except Exception as e:                  # noqa: BLE001
                data, err = None, str(e)
        else:
            data, err = audit(lock)
        if data is None:
            unchecked.append((lock, err))
            continue
        for v in (data.get("vulnerabilities") or {}).get("list") or []:
            adv, pkg = v.get("advisory") or {}, v.get("package") or {}
            found.setdefault(adv.get("id", "?"), []).append(
                (pkg.get("name", "?"), pkg.get("version", "?"), lock)
            )
        for kind, items in (data.get("warnings") or {}).items():
            warn_count += len(items or [])

    def covered(adv, crate, ver):
        entry = ALLOW.get(adv)
        if entry is None:
            return False
        if isinstance(entry, str):
            return True
        return f"{crate} {ver}" in entry["only"]

    unexpected = {}
    for adv, occurrences in found.items():
        loose = [o for o in occurrences if not covered(adv, o[0], o[1])]
        if loose:
            unexpected[adv] = loose

    stale = [k for k in ALLOW if k not in found]
    # A version-pinned entry is also stale when a pair it names is gone: the
    # pin stops describing the tree the moment that line moves.
    for adv, entry in ALLOW.items():
        if adv in found and isinstance(entry, dict):
            seen = {f"{c} {v}" for c, v, _ in found[adv]}
            for pair in entry["only"]:
                if pair not in seen:
                    stale.append(f"{adv} (no longer at {pair})")

    if unexpected:
        print("Advisories that are not in the allow list:\n")
        for adv in sorted(unexpected):
            for crate, ver, lock in unexpected[adv]:
                print(f"  {adv}  {crate} {ver}")
                print(f"      {lock}")
        print(
            "\nFix each, or add it to ALLOW in scripts/check-advisories.py with the\n"
            "reason it can be left — unreachable, dev-only, or pinned upstream."
        )
    if stale:
        print("\nAllow-list entries that no longer match anything:\n")
        for adv in sorted(stale):
            entry = ALLOW.get(adv.split(" (")[0])
            why = entry if isinstance(entry, str) else (entry or {}).get("why", "")
            print(f"  {adv}  — {why}")
        print(
            "\nThe exposure is gone. Remove the entry, so the list keeps describing\n"
            "the tree instead of hiding it."
        )
    if unchecked:
        print("\nCould not be audited (this is not a verdict on the lockfile):\n")
        for lock, why in unchecked:
            print(f"  {lock}: {why}")

    if unexpected or stale or unchecked:
        return 1
    print(
        f"check-advisories: {len(sources)} lockfiles, "
        f"{len(found)} allowed advisories, {warn_count} warnings (not gated)."
    )
    return 0


if __name__ == "__main__":
    sys.exit(main())