You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "L. C. Hsieh (Jira)" <ji...@apache.org> on 2026/10/19 23:42:00 UTC
[jira] [Updated] (SPARK-60370) Run cargo audit in CI on a daily schedule and on dependency changes
[ https://issues.apache.org/jira/browse/SPARK-60370?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
L. C. Hsieh updated SPARK-60370:
--------------------------------
Description:
Nothing in CI checks dependencies against the RustSec advisory database.
Three advisories (h2, rustls, rsa) sat on main with CI green and were
found only by running `cargo audit` by hand. The h2 fix from SPARK-60115
is a --precise pin on a transitive dependency, so a later `cargo update`
or a hyper/tonic bump can silently undo it.
Add a workflow that runs `cargo audit`:
- daily on main (schedule), to catch newly published advisories;
- on pull requests that change Cargo.lock, Cargo.toml, crates/*/Cargo.toml,
.cargo/audit.toml, or the workflow itself, to stop a change from
introducing a vulnerable version.
It deliberately does not run on every PR. The advisory database changes
daily, so gating every PR on it would turn unrelated PRs red whenever a
new advisory is published. That is the same failure mode SPARK-59989 fixed
for the floating Rust toolchain. Newly published advisories surface on the
scheduled run; PRs are gated only on the dependency changes they make.
RUSTSEC-2023-0071 (rsa, no fixed release) is ignored in .cargo/audit.toml,
with a pointer to SPARK-60370 that tracks removing the ignore. cargo-audit
is installed with `cargo install --locked` rather than a third-party
action, to stay within the ASF GitHub Actions allowlist.
was:
Nothing in CI checks dependencies against the RustSec advisory database.
Three advisories (h2, rustls, rsa) sat on main with CI green and were
found only by running `cargo audit` by hand. The h2 fix from SPARK-60115
is a --precise pin on a transitive dependency, so a later `cargo update`
or a hyper/tonic bump can silently undo it.
Add a workflow that runs `cargo audit`:
- daily on main (schedule), to catch newly published advisories;
- on pull requests that change Cargo.lock, Cargo.toml, crates/*/Cargo.toml,
.cargo/audit.toml, or the workflow itself, to stop a change from
introducing a vulnerable version.
It deliberately does not run on every PR. The advisory database changes
daily, so gating every PR on it would turn unrelated PRs red whenever a
new advisory is published. That is the same failure mode SPARK-59989 fixed
for the floating Rust toolchain. Newly published advisories surface on the
scheduled run; PRs are gated only on the dependency changes they make.
RUSTSEC-2023-0071 (rsa, no fixed release) is ignored in .cargo/audit.toml,
with a pointer to SPARK-XXXXX that tracks removing the ignore. cargo-audit
is installed with `cargo install --locked` rather than a third-party
action, to stay within the ASF GitHub Actions allowlist.
> Run cargo audit in CI on a daily schedule and on dependency changes
> -------------------------------------------------------------------
>
> Key: SPARK-60370
> URL: https://issues.apache.org/jira/browse/SPARK-60370
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
>
> Nothing in CI checks dependencies against the RustSec advisory database.
> Three advisories (h2, rustls, rsa) sat on main with CI green and were
> found only by running `cargo audit` by hand. The h2 fix from SPARK-60115
> is a --precise pin on a transitive dependency, so a later `cargo update`
> or a hyper/tonic bump can silently undo it.
> Add a workflow that runs `cargo audit`:
> - daily on main (schedule), to catch newly published advisories;
> - on pull requests that change Cargo.lock, Cargo.toml, crates/*/Cargo.toml,
> .cargo/audit.toml, or the workflow itself, to stop a change from
> introducing a vulnerable version.
> It deliberately does not run on every PR. The advisory database changes
> daily, so gating every PR on it would turn unrelated PRs red whenever a
> new advisory is published. That is the same failure mode SPARK-59989 fixed
> for the floating Rust toolchain. Newly published advisories surface on the
> scheduled run; PRs are gated only on the dependency changes they make.
> RUSTSEC-2023-0071 (rsa, no fixed release) is ignored in .cargo/audit.toml,
> with a pointer to SPARK-60370 that tracks removing the ignore. cargo-audit
> is installed with `cargo install --locked` rather than a third-party
> action, to stay within the ASF GitHub Actions allowlist.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org