From 7c1a8967e0d2e12fb8b2ec3ae9783869b4a8be9f Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Sun, 18 Oct 2026 16:16:52 -0400 Subject: [PATCH] chore(deny): check buzz-mesh-smoke in the root graph again (#8424) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Removes the whole-crate `[graph] exclude = ["buzz-mesh-smoke"]` from `deny.toml`, so the root `cargo-deny` check covers `buzz-mesh-smoke` and its `mesh-llm` dependency again. The advisories that crate brings in are ignored one ID at a time instead, each naming its dependency path and when to remove it: - `RUSTSEC-2026-0367` / `0368` / `0369` — `zip` 8.6.0 extraction bugs via `buzz-mesh-smoke` → `mesh-llm` v0.76.2. `mesh-llm` copies entries manually and never calls `ZipArchive::extract`. Remove on the `mesh-llm` release that ships Mesh-LLM/mesh-llm#2471. - `RUSTSEC-2026-0370` / `0371` / `0372` — unmaintained (not vulnerable) `zvariant`, `zbus_names`, `zvariant_derive` via `mesh-llm` → `keyring` 4 → `secret-service` 5 → `zbus` 5. Remove when that stack leaves `zbus` 5. Any new advisory under `mesh-llm` now fails CI instead of being silently excluded. No workflow or lockfile changes; the old beta desktop crate in `desktop/` is not checked. Signed-off-by: Will Pfleger Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz> --- deny.toml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/deny.toml b/deny.toml index 2362c3f7c0..6ef1126096 100644 --- a/deny.toml +++ b/deny.toml @@ -1,9 +1,3 @@ -[graph] -# buzz-mesh-smoke is a test-only hardware smoke-test crate; nothing from it ships. -# It is the only root-workspace crate depending on mesh-llm, whose zip/zbus -# advisories have no usable upstream fix for our pinned version. -exclude = ["buzz-mesh-smoke"] - [advisories] ignore = [ # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant. @@ -32,6 +26,23 @@ ignore = [ # Keep the exact NetEQ pin and the wrapper ban below together. Re-audit or # remove this exception when NetEQ removes/updates the unused dependency. { id = "RUSTSEC-2026-0293", reason = "unused dependency of audited, exactly pinned neteq 0.8.3; no Rust references to ringbuf; other consumers forbidden by bans.deny" }, + # zip 8.6.0 < 9: extraction keeps setuid/setgid bits (0367), creates + # symlinks that escape the destination (0368) and applies permissions through + # symlinks (0369). Only path: buzz-mesh-smoke → mesh-llm v0.76.2 → + # mesh-llm-host-runtime / mesh-llm-plugin-manager / mesh-llm-system → zip 8. + # mesh-llm's zip readers copy entries manually and never call + # ZipArchive::extract; recheck if that changes. Remove on the mesh-llm bump + # that ships Mesh-LLM/mesh-llm#2471. + { id = "RUSTSEC-2026-0367", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + { id = "RUSTSEC-2026-0368", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + { id = "RUSTSEC-2026-0369", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + # zbus 5 D-Bus crates (zvariant, zbus_names, zvariant_derive) — unmaintained, + # not vulnerable. Only path: buzz-mesh-smoke → mesh-llm → keyring 4 → + # zbus-secret-service-keyring-store / secret-service 5 → zbus 5. + # Remove when mesh-llm's keyring stack moves off zbus 5. + { id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, ] [licenses]