sigstore / sigstore-rs

An experimental Rust crate for sigstore
https://sigstore.github.io/sigstore-rs/sigstore/
Apache License 2.0
156 stars 48 forks source link

cargo audit: ignore RUSTSEC-2023-0071 #321

Closed jleightcap closed 6 months ago

jleightcap commented 6 months ago

Current cargo audit workflow is failing due to RSA timing sidechannel attack. Not relevant for this use (and to be refactored in #307), so add to .cargo/audit.toml ignorelist with rationale.

(CC @woodruffw)