open-standards/scripts/check-advisories.py

#!/usr/bin/env python3
#
# check-advisories.py — no workspace carries a security advisory nobody has read.
#
# This tree holds many workspaces, and a vulnerable crate usually arrives
# transitively, in a lockfile nobody edited, for a reason nobody chose. Without
# a gate the backlog only grows, and it grew: a sweep in October 2026 found 142
# vulnerability instances across 47 lockfiles, among them a WASM runtime with a
# filesystem sandbox escape in the one component whose job is confinement.
# Nothing had failed, because nothing was looking.
#
# For every tracked Cargo.lock this runs
#
#     cargo audit --file <lock> --json
#
# and fails on any advisory that is not in ALLOW below. It reads the advisory
# database and the lockfile; it builds nothing.
#
# ALLOW is the whole point. An advisory may be left in place — upstream has no
# fixed release, or the vulnerable call is unreachable here — but only in
# writing, with the reason next to the id. Two rules keep that honest:
#
#   * an advisory that is not listed fails the run, so a new one has to be
#     looked at rather than accumulated;
#   * a listed advisory that no longer appears anywhere ALSO fails the run, so
#     an entry cannot outlive the exposure it excused. An allow list that is
#     never pruned stops describing the tree and starts hiding it.
#
# Warnings (unmaintained, unsound, yanked) are counted and printed but do not
# fail the run: they are advice about maintenance, not a reachable defect, and
# gating on them would bury the vulnerabilities in noise. They are printed so
# the number stays visible rather than unknown.
#
#   check-advisories.py                  every tracked Cargo.lock, less SKIP
#   check-advisories.py DIR ...          exactly these directories
#   check-advisories.py --from-json F... audit JSON already captured (self-test)
#
# Exit 0: every advisory found is allowed, and every allowed advisory was found.
# Exit 1: otherwise — including when a lockfile could not be audited at all,
# which is reported under its own heading so an error is never read as "clean".
import json
import os
import subprocess
import sys

# Advisories left in place on purpose. Each needs the reason, and each must
# still be reported by at least one lockfile or this check fails.
ALLOW = {
    # ── Unreachable here ────────────────────────────────────────────────────
    # All three are faults in `extract()`: SUID/SGID bits preserved from the
    # archive, symlinks whose targets escape the destination, and permissions
    # applied through those symlinks. Nothing in this tree extracts an archive
    # — there is no `ZipArchive` or `ZipStreamReader` call site. zip arrives
    # under candle-core and the wasm toolchain.
    "RUSTSEC-2026-0367": "zip: extract-only; nothing here extracts an archive",
    "RUSTSEC-2026-0368": "zip: extract-only; nothing here extracts an archive",
    "RUSTSEC-2026-0369": "zip: extract-only; nothing here extracts an archive",
    "RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here extracts",
    # The Marvin attack recovers an RSA key from the timing of private-key
    # decryption. There is no fixed release of `rsa` at all. It reaches
    # sandbox-rs and wai-rs transitively and neither holds an RSA private key
    # nor decrypts: openpay's unused direct dependency was removed outright.
    "RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here",
    # ── Not in a shipped artifact ──────────────────────────────────────────
    # The production MLS path (joule-moq-mls) resolves the patched hpke-rs
    # 0.7.0. These four are the old 0.2.0, reached only through a
    # [dev-dependencies] edge of joule-code-collab, which still pins the
    # openmls 0.6/0.3 stack. Test graph only; aligning it to the 0.9.1/0.6.0
    # stack already used in-repo would remove them.
    "RUSTSEC-2026-0069": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
    "RUSTSEC-2026-0070": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
    "RUSTSEC-2026-0071": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
    "RUSTSEC-2026-0072": "hpke-rs-rust-crypto 0.2.0: dev-dependency only",
    # ── Pinned by a dependency; needs an upstream release ──────────────────
    # hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are
    # panics on short or malformed hybrid keys — denial of service, not memory
    # corruption. Fixed by an openmls/hpke-rs release, not from here.
    "RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
    "RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
    # quick-xml is 0.41 everywhere the version is ours to choose. openpay also
    # resolves 0.37.5 through open-payments-iso20022 1.0.10 (no later release
    # exists), and smart-byte resolves 0.39.4 through plist -> netdev ->
    # netwatch -> iroh. NOTE: the openpay path is the same ISO 20022 surface we
    # harden directly, so this entry is a known remaining exposure on a payment
    # ingestion path, not a dismissal. Drop it the moment upstream ships.
    "RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: pinned by open-payments-iso20022 and iroh",
    "RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused here; dependents pin the version",
    # h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive;
    # the fix is a major move for the dependent.
    "RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent",
    # hickory-proto 0.25.2 under smart-byte via iroh. -0118 has no fixed
    # release; -0119 needs 0.26, which iroh does not take yet.
    "RUSTSEC-2026-0118": "hickory-proto: no fixed release; transitive under iroh",
    "RUSTSEC-2026-0119": "hickory-proto: 0.26 not taken by iroh yet",
    # pyo3 0.28.3 under eoc-rs. Both need 0.29, a breaking move for the binding.
    "RUSTSEC-2026-0176": "pyo3: 0.29 is a breaking move for the binding",
    "RUSTSEC-2026-0177": "pyo3: 0.29 is a breaking move for the binding",
}

# Lockfiles cargo does not read: a vendored crate's own lock, kept with the
# vendored source. Each must still exist, or the entry is stale.
SKIP = (
    "jouledesk/jouledesk-rs/vendor/libwebrtc",
    "joule-code/joule-code-rs/vendor/wtransport",
)


def discover():
    root = subprocess.run(
        ["git", "rev-parse", "--show-toplevel"], capture_output=True, text=True
    ).stdout.strip()
    if not root:
        sys.exit("check-advisories: not in a git checkout.")
    os.chdir(root)
    for d in SKIP:
        if not os.path.isfile(os.path.join(d, "Cargo.lock")):
            sys.exit(
                f"check-advisories: the skip list names {d}, which holds no "
                "Cargo.lock. Remove the entry."
            )
    out = subprocess.run(["git", "ls-files"], capture_output=True, text=True).stdout
    locks = [
        p
        for p in out.splitlines()
        if p == "Cargo.lock" or p.endswith("/Cargo.lock")
        if os.path.dirname(p) not in SKIP
    ]
    return sorted(locks)


def audit(lock):
    """Return (parsed_json, error_text). Exactly one is None."""
    try:
        p = subprocess.run(
            ["cargo", "audit", "--file", lock, "--json", "--color", "never"],
            capture_output=True,
            text=True,
            timeout=600,
        )
    except FileNotFoundError:
        return None, "cargo is not on PATH"
    except subprocess.TimeoutExpired:
        return None, "cargo audit timed out"
    # cargo audit exits non-zero when it finds something, so the exit status is
    # not the signal; absence of parseable JSON is.
    try:
        return json.loads(p.stdout), None
    except json.JSONDecodeError:
        tail = (p.stderr or p.stdout or "").strip().splitlines()
        return None, "; ".join(tail[-3:]) or "no JSON on stdout"


def main():
    args = sys.argv[1:]
    from_json = False
    if args and args[0] == "--from-json":
        from_json, args = True, args[1:]

    if from_json:
        sources = [(f, None) for f in args]
    elif args:
        sources = [(os.path.join(d, "Cargo.lock"), None) for d in args]
    else:
        sources = [(l, None) for l in discover()]
    if not sources:
        sys.exit("check-advisories: found no Cargo.lock to check.")

    found = {}       # id -> [(crate, version, lock)]
    unchecked = []   # (lock, why)
    warn_count = 0

    for lock, _ in sources:
        if from_json:
            try:
                with open(lock) as fh:
                    data, err = json.load(fh), None
            except Exception as e:                  # noqa: BLE001
                data, err = None, str(e)
        else:
            data, err = audit(lock)
        if data is None:
            unchecked.append((lock, err))
            continue
        for v in (data.get("vulnerabilities") or {}).get("list") or []:
            adv, pkg = v.get("advisory") or {}, v.get("package") or {}
            found.setdefault(adv.get("id", "?"), []).append(
                (pkg.get("name", "?"), pkg.get("version", "?"), lock)
            )
        for kind, items in (data.get("warnings") or {}).items():
            warn_count += len(items or [])

    unexpected = {k: v for k, v in found.items() if k not in ALLOW}
    stale = [k for k in ALLOW if k not in found]

    if unexpected:
        print("Advisories that are not in the allow list:\n")
        for adv in sorted(unexpected):
            for crate, ver, lock in unexpected[adv]:
                print(f"  {adv}  {crate} {ver}")
                print(f"      {lock}")
        print(
            "\nFix each, or add it to ALLOW in scripts/check-advisories.py with the\n"
            "reason it can be left — unreachable, dev-only, or pinned upstream."
        )
    if stale:
        print("\nAllow-list entries that no longer match anything:\n")
        for adv in sorted(stale):
            print(f"  {adv}  — {ALLOW[adv]}")
        print(
            "\nThe exposure is gone. Remove the entry, so the list keeps describing\n"
            "the tree instead of hiding it."
        )
    if unchecked:
        print("\nCould not be audited (this is not a verdict on the lockfile):\n")
        for lock, why in unchecked:
            print(f"  {lock}: {why}")

    if unexpected or stale or unchecked:
        return 1
    print(
        f"check-advisories: {len(sources)} lockfiles, "
        f"{len(found)} allowed advisories, {warn_count} warnings (not gated)."
    )
    return 0


if __name__ == "__main__":
    sys.exit(main())