Closed aoudiamoncef closed 8 months ago
cc @Leo-Besancon
FYI, For cargo audit there is already an issue that list all the actions to be (or already) taken to fix them : https://github.com/massalabs/massa/issues/4396
@Leo-Besancon @AurelienFT , I added a small licence check for all our deps. We should analyse It, because licensing is hard and may be use a BOT to handle this is a good idea.
Hi, thanks for the analysis! Here's what I gathered:
cargo-auditable
Please see if we can update / change the dependencies listed. (for example, the .5 was replaced by .6 here: https://crates.io/crates/rustls-webpki/versions)
cargo-crev
I think nothing was verified here, see the output.
cargo-hack:
We can open an issue on that, but it's more about cleaning than security
This issue serves as a summary of the security checks performed on our codebase using various Cargo tools. The purpose of these checks is to identify and address potential security vulnerabilities in our Rust project.
Tools Used:
Results:
All scans was run on main branch with the fa9bd21ceac04da1819d3afef31bc0563ddd7f6f commit.
advisories ok, bans ok, licenses FAILED, sources ok