From fe722ffa31fc399eff1e9a13abc541d8fca89c17 Mon Sep 17 00:00:00 2001 From: lym953 <10097700+lym953@users.noreply.github.com> Date: Wed, 14 Oct 2026 15:25:37 -0400 Subject: [PATCH] ci: ignore three new rustls advisories in cargo-audit, matching the RUSTSEC-2026-0285 waiver RUSTSEC-2026-0346, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 are fixed in rustls 0.23.46, which requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/rs_ci.yml | 2 +- bottlecap/.cargo/audit.toml | 17 +++++++++++------ 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/rs_ci.yml b/.github/workflows/rs_ci.yml index 5459220fb..63e791af8 100644 --- a/.github/workflows/rs_ci.yml +++ b/.github/workflows/rs_ci.yml @@ -190,7 +190,7 @@ jobs: working-directory: bottlecap # Mirrors bottlecap/.cargo/audit.toml. This action only reads ./.cargo/audit.toml # relative to its cwd (repo root), so the crate-local ignore list is never loaded in CI. - ignore: RUSTSEC-2026-0285 + ignore: RUSTSEC-2026-0285,RUSTSEC-2026-0346,RUSTSEC-2026-0348,RUSTSEC-2026-0349 cargo-lockfile-scan: name: Lockfile Scan diff --git a/bottlecap/.cargo/audit.toml b/bottlecap/.cargo/audit.toml index 016965b0f..f37b4a71d 100644 --- a/bottlecap/.cargo/audit.toml +++ b/bottlecap/.cargo/audit.toml @@ -1,7 +1,12 @@ -# RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires -# aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 -# certification. Remove this ignore once a FIPS-certified aws-lc-rs is -# available. Trivy reports the same advisory as GHSA-2mjx-qc3c-rqvc, ignored in -# .trivyignore.yaml. +# These rustls advisories are fixed in rustls >= 0.23.45 (RUSTSEC-2026-0285) or +# >= 0.23.46 (the other three), but those versions require aws-lc-rs >= 1.18, +# which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Remove these +# ignores once a FIPS-certified aws-lc-rs is available. Trivy reports +# RUSTSEC-2026-0285 as GHSA-2mjx-qc3c-rqvc, ignored in .trivyignore.yaml. [advisories] -ignore = ["RUSTSEC-2026-0285"] +ignore = [ + "RUSTSEC-2026-0285", + "RUSTSEC-2026-0346", + "RUSTSEC-2026-0348", + "RUSTSEC-2026-0349", +]