From 8e039453e213289158c539efb05f85008130727c Mon Sep 17 00:00:00 2001 From: "Denis S. Soldatov aka General-Beck" Date: Mon, 6 Jul 2020 13:44:30 +0300 Subject: [PATCH] Add cargo deny (#166) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Add cargo deny * deny - master * Copy deny.toml to . * cargo deny check * upload artifacts * install cargo deny * typo * up install cargo deny * update archive * typo * path's * allow failure cargo deny * allew failure log * cargo deny init * add deny.toml and compare with embark actions * fix options * Fix cargo deny. * Remove cargo audit (same as deny) Co-authored-by: Tomasz Drwięga --- .github/workflows/audit.yml | 18 -- .github/workflows/deny.yml | 59 ++++++ bin/node/node/Cargo.toml | 1 + bin/node/runtime/Cargo.toml | 1 + deny.toml | 190 +++++++++++++++++++ modules/currency-exchange/Cargo.toml | 1 + modules/ethereum-contract/builtin/Cargo.toml | 1 + modules/ethereum/Cargo.toml | 1 + modules/substrate/Cargo.toml | 1 + primitives/currency-exchange/Cargo.toml | 1 + primitives/ethereum-poa/Cargo.toml | 1 + relays/ethereum/Cargo.toml | 1 + relays/substrate/Cargo.toml | 1 + 13 files changed, 259 insertions(+), 18 deletions(-) delete mode 100644 .github/workflows/audit.yml create mode 100644 .github/workflows/deny.yml create mode 100644 deny.toml diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml deleted file mode 100644 index 4c6b7e224d98..000000000000 --- a/.github/workflows/audit.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: Security audit -on: - pull_request: - paths: Cargo.lock - schedule: - - cron: '0 0 * * *' -jobs: - security_audit: - runs-on: ubuntu-latest - steps: - - name: Checkout sources - uses: actions/checkout@v1 - with: - fetch-depth: 50 - - name: Run cargo audit - uses: actions-rs/audit-check@v1 - with: - token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml new file mode 100644 index 000000000000..65831c440abb --- /dev/null +++ b/.github/workflows/deny.yml @@ -0,0 +1,59 @@ +name: Cargo deny + +on: + pull_request: + paths: Cargo.lock + schedule: + - cron: '* * * * 0' + push: + branches: + - master + tags: + - v* + paths-ignore: + - 'README.md' +jobs: +## Test stage + test: + name: Check + runs-on: ubuntu-latest + steps: + - name: Checkout sources & submodules + uses: actions/checkout@master + - name: Install toolchain + uses: actions-rs/toolchain@master + with: + profile: minimal + toolchain: stable + - name: Install cargo deny + run: | + mkdir -p ~/.cargo/bin + CARGO_DENY_RELEASE=$(curl -L -s -H 'Accept: application/json' https://github.com/EmbarkStudios/cargo-deny/releases/latest) + CARGO_DENY_VERSION=$(echo $CARGO_DENY_RELEASE | sed -e 's/.*"tag_name":"\([^"]*\)".*/\1/') + CARGO_DENY_URL="https://github.com/EmbarkStudios/cargo-deny/releases/download/$CARGO_DENY_VERSION/cargo-deny-$CARGO_DENY_VERSION-x86_64-unknown-linux-musl.tar.gz" + echo "Downloading cargo-deny from: $CARGO_DENY_URL" + curl -sLO $CARGO_DENY_URL + tar -xvzf cargo-deny-$CARGO_DENY_VERSION-x86_64-unknown-linux-musl.tar.gz + cd cargo-deny-$CARGO_DENY_VERSION-x86_64-unknown-linux-musl + chmod +x cargo-deny + mv cargo-deny ~/.cargo/bin + - name: Cargo init + continue-on-error: true + run: cargo deny init + - name: Cargo deny + continue-on-error: true + run: cargo deny check --hide-inclusion-graph + - name: Build deny log + continue-on-error: true + run: cargo deny check 2> deny.log + - name: Upload deny.log + uses: actions/upload-artifact@v1 + with: + name: deny.log + path: deny.log + + cargo-deny: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - uses: EmbarkStudios/cargo-deny-action@v1 diff --git a/bin/node/node/Cargo.toml b/bin/node/node/Cargo.toml index 10122e07a1ad..0b7b5ab6ab44 100644 --- a/bin/node/node/Cargo.toml +++ b/bin/node/node/Cargo.toml @@ -6,6 +6,7 @@ edition = "2018" build = "build.rs" homepage = "https://substrate.dev" repository = "https://github.com/paritytech/parity-bridges-common/" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [[bin]] name = "bridge-node" diff --git a/bin/node/runtime/Cargo.toml b/bin/node/runtime/Cargo.toml index 3e473687334e..1d75dc3fecb7 100644 --- a/bin/node/runtime/Cargo.toml +++ b/bin/node/runtime/Cargo.toml @@ -5,6 +5,7 @@ authors = ["Parity Technologies "] edition = "2018" homepage = "https://substrate.dev" repository = "https://github.com/paritytech/parity-bridges-common/" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] hex-literal = "0.2" diff --git a/deny.toml b/deny.toml new file mode 100644 index 000000000000..f0f3c98d4fee --- /dev/null +++ b/deny.toml @@ -0,0 +1,190 @@ +# This template contains all of the possible sections and their default values + +# Note that all fields that take a lint level have these possible values: +# * deny - An error will be produced and the check will fail +# * warn - A warning will be produced, but the check will not fail +# * allow - No warning or error will be produced, though in some cases a note +# will be + +# The values provided in this template are the default values that will be used +# when any section or field is not specified in your own configuration + +# If 1 or more target triples (and optionally, target_features) are specified, +# only the specified targets will be checked when running `cargo deny check`. +# This means, if a particular package is only ever used as a target specific +# dependency, such as, for example, the `nix` crate only being used via the +# `target_family = "unix"` configuration, that only having windows targets in +# this list would mean the nix crate, as well as any of its exclusive +# dependencies not shared by any other crates, would be ignored, as the target +# list here is effectively saying which targets you are building for. +targets = [ + # The triple can be any string, but only the target triples built in to + # rustc (as of 1.40) can be checked against actual config expressions + #{ triple = "x86_64-unknown-linux-musl" }, + # You can also specify which target_features you promise are enabled for a + # particular target. target_features are currently not validated against + # the actual valid features supported by the target architecture. + #{ triple = "wasm32-unknown-unknown", features = ["atomics"] }, +] + +# This section is considered when running `cargo deny check advisories` +# More documentation for the advisories section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html +[advisories] +# The path where the advisory database is cloned/fetched into +db-path = "~/.cargo/advisory-db" +# The url of the advisory database to use +db-url = "https://github.com/rustsec/advisory-db" +# The lint level for security vulnerabilities +vulnerability = "deny" +# The lint level for unmaintained crates +unmaintained = "warn" +# The lint level for crates that have been yanked from their source registry +yanked = "warn" +# The lint level for crates with security notices. Note that as of +# 2019-12-17 there are no security notice advisories in +# https://github.com/rustsec/advisory-db +notice = "warn" +# A list of advisory IDs to ignore. Note that ignored advisories will still +# output a note when they are encountered. +ignore = [ + # yaml-rust < clap. Not feasible to upgrade and also not possible to trigger in practice. + "RUSTSEC-2018-0006" +] +# Threshold for security vulnerabilities, any vulnerability with a CVSS score +# lower than the range specified will be ignored. Note that ignored advisories +# will still output a note when they are encountered. +# * None - CVSS Score 0.0 +# * Low - CVSS Score 0.1 - 3.9 +# * Medium - CVSS Score 4.0 - 6.9 +# * High - CVSS Score 7.0 - 8.9 +# * Critical - CVSS Score 9.0 - 10.0 +#severity-threshold = + +# This section is considered when running `cargo deny check licenses` +# More documentation for the licenses section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html +[licenses] +# The lint level for crates which do not have a detectable license +unlicensed = "deny" +# List of explictly allowed licenses +# See https://spdx.org/licenses/ for list of possible licenses +# [possible values: any SPDX 3.7 short identifier (+ optional exception)]. +allow = [] +# List of explictly disallowed licenses +# See https://spdx.org/licenses/ for list of possible licenses +# [possible values: any SPDX 3.7 short identifier (+ optional exception)]. +deny = [ + #"Nokia", +] +# Lint level for licenses considered copyleft +copyleft = "allow" +# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses +# * both - The license will be approved if it is both OSI-approved *AND* FSF +# * either - The license will be approved if it is either OSI-approved *OR* FSF +# * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF +# * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved +# * neither - This predicate is ignored and the default lint level is used +allow-osi-fsf-free = "either" +# Lint level used when no other predicates are matched +# 1. License isn't in the allow or deny lists +# 2. License isn't copyleft +# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither" +default = "deny" +# The confidence threshold for detecting a license from license text. +# The higher the value, the more closely the license text must be to the +# canonical license text of a valid SPDX license file. +# [possible values: any between 0.0 and 1.0]. +confidence-threshold = 0.9 +# Allow 1 or more licenses on a per-crate basis, so that particular licenses +# aren't accepted for every possible crate as with the normal allow list +exceptions = [ + # Each entry is the crate and version constraint, and its specific allow + # list + #{ allow = ["Zlib"], name = "adler32", version = "*" }, +] + +# Some crates don't have (easily) machine readable licensing information, +# adding a clarification entry for it allows you to manually specify the +# licensing information +[[licenses.clarify]] +# The name of the crate the clarification applies to +name = "ring" +# THe optional version constraint for the crate +#version = "*" +# The SPDX expression for the license requirements of the crate +expression = "OpenSSL" +# One or more files in the crate's source used as the "source of truth" for +# the license expression. If the contents match, the clarification will be used +# when running the license check, otherwise the clarification will be ignored +# and the crate will be checked normally, which may produce warnings or errors +# depending on the rest of your configuration +license-files = [ + # Each entry is a crate relative path, and the (opaque) hash of its contents + { path = "LICENSE", hash = 0xbd0eed23 } +] +[[licenses.clarify]] +name = "webpki" +expression = "ISC" +license-files = [{ path = "LICENSE", hash = 0x001c7e6c }] + +[licenses.private] +# If true, ignores workspace crates that aren't published, or are only +# published to private registries +ignore = false +# One or more private registries that you might publish crates to, if a crate +# is only published to private registries, and ignore is true, the crate will +# not have its license(s) checked +registries = [ + #"https://sekretz.com/registry +] + +# This section is considered when running `cargo deny check bans`. +# More documentation about the 'bans' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html +[bans] +# Lint level for when multiple versions of the same crate are detected +multiple-versions = "warn" +# The graph highlighting used when creating dotgraphs for crates +# with multiple versions +# * lowest-version - The path to the lowest versioned duplicate is highlighted +# * simplest-path - The path to the version with the fewest edges is highlighted +# * all - Both lowest-version and simplest-path are used +highlight = "lowest-version" +# List of crates that are allowed. Use with care! +allow = [ + #{ name = "ansi_term", version = "=0.11.0" }, +] +# List of crates to deny +deny = [ + { name = "parity-util-mem", version = "<0.6" } + # Each entry the name of a crate and a version range. If version is + # not specified, all versions will be matched. +] +# Certain crates/versions that will be skipped when doing duplicate detection. +skip = [ + #{ name = "ansi_term", version = "=0.11.0" }, +] +# Similarly to `skip` allows you to skip certain crates during duplicate +# detection. Unlike skip, it also includes the entire tree of transitive +# dependencies starting at the specified crate, up to a certain depth, which is +# by default infinite +skip-tree = [ + #{ name = "ansi_term", version = "=0.11.0", depth = 20 }, +] + +# This section is considered when running `cargo deny check sources`. +# More documentation about the 'sources' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html +[sources] +# Lint level for what to happen when a crate from a crate registry that is not +# in the allow list is encountered +unknown-registry = "deny" +# Lint level for what to happen when a crate from a git repository that is not +# in the allow list is encountered +unknown-git = "allow" +# List of URLs for allowed crate registries. Defaults to the crates.io index +# if not specified. If it is specified but empty, no registries are allowed. +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +# List of URLs for allowed Git repositories +allow-git = [] diff --git a/modules/currency-exchange/Cargo.toml b/modules/currency-exchange/Cargo.toml index 7847483bc8b7..b9a71150a18e 100644 --- a/modules/currency-exchange/Cargo.toml +++ b/modules/currency-exchange/Cargo.toml @@ -4,6 +4,7 @@ description = "A Substrate Runtime module that accepts 'lock funds' transactions version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] serde = { version = "1.0", optional = true } diff --git a/modules/ethereum-contract/builtin/Cargo.toml b/modules/ethereum-contract/builtin/Cargo.toml index e9b938ccf86e..d8f4cf8fb9f4 100644 --- a/modules/ethereum-contract/builtin/Cargo.toml +++ b/modules/ethereum-contract/builtin/Cargo.toml @@ -4,6 +4,7 @@ description = "Small crate that helps Solidity contract to verify finality proof version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] diff --git a/modules/ethereum/Cargo.toml b/modules/ethereum/Cargo.toml index bb022397f394..32a5b997d119 100644 --- a/modules/ethereum/Cargo.toml +++ b/modules/ethereum/Cargo.toml @@ -4,6 +4,7 @@ description = "A Substrate Runtime module that is able to verify PoA headers and version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] serde = { version = "1.0", optional = true } diff --git a/modules/substrate/Cargo.toml b/modules/substrate/Cargo.toml index e55b0ac4b216..605d70231f7c 100644 --- a/modules/substrate/Cargo.toml +++ b/modules/substrate/Cargo.toml @@ -3,6 +3,7 @@ name = "pallet-bridge" version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html diff --git a/primitives/currency-exchange/Cargo.toml b/primitives/currency-exchange/Cargo.toml index 91fddf25480a..1bbfac6a6134 100644 --- a/primitives/currency-exchange/Cargo.toml +++ b/primitives/currency-exchange/Cargo.toml @@ -4,6 +4,7 @@ description = "Primitives of currency exchange module." version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false } diff --git a/primitives/ethereum-poa/Cargo.toml b/primitives/ethereum-poa/Cargo.toml index a444d659bcee..0ccabfaa592b 100644 --- a/primitives/ethereum-poa/Cargo.toml +++ b/primitives/ethereum-poa/Cargo.toml @@ -4,6 +4,7 @@ description = "Primitives of Ethereum PoA Bridge module." version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] serde = { version = "1.0", optional = true } diff --git a/relays/ethereum/Cargo.toml b/relays/ethereum/Cargo.toml index fd7c69429bdf..d2e5758fe888 100644 --- a/relays/ethereum/Cargo.toml +++ b/relays/ethereum/Cargo.toml @@ -3,6 +3,7 @@ name = "ethereum-poa-relay" version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] ansi_term = "0.12" diff --git a/relays/substrate/Cargo.toml b/relays/substrate/Cargo.toml index 2b8e26f6286a..e8052b5b1d91 100644 --- a/relays/substrate/Cargo.toml +++ b/relays/substrate/Cargo.toml @@ -3,6 +3,7 @@ name = "substrate-bridge" version = "0.1.0" authors = ["Parity Technologies "] edition = "2018" +license = "GPL-3.0-or-later WITH Classpath-exception-2.0" [dependencies] async-std = "=1.5.0"