mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Add an importable flag to audits #520

Closed mystor closed 1 year ago

mystor commented 1 year ago

This adds a new option to audits, importable, which can be set to false to mark an audit such that it will be ignored when importing. This will be enabled by default for new audits containing git revisions, allowing those entries to be cleaned up when they are no longer necessary.

Currently this patch adds no mechanism to automatically collapse sequences of non-importable audits or similar, so cleanup will still need to be manual. This can be added in the future in a backwards-compatible way.