rust-cargo-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Rust Cargo Audit

> Defends against **OWASP AST08 (Update tampering)** for the Rust
> dependency surface. `cargo audit` consults the
> [RustSec Advisory Database](https://rustsec.org) for known
> vulnerabilities in your `Cargo.lock`; `cargo-deny` extends to license,
> source, and ban-list enforcement. Together they close the
> dependency-side of the supply-chain attack surface: a malicious
> dependency-bump PR (typosquatting on a popular crate, a compromised
> maintainer pushing a backdoored release) gets flagged before merge.

**Tradeoff:** CI gates on dependency advisories slow some PRs
(legitimate updates to advisory-flagged crates need a manual
ack-and-merge). Worth it: the alternative is silent acceptance of a
known-vulnerable dependency, which becomes an open vulnerability
ticket the moment a researcher publishes details.

---

## Why this matters

Cargo's default behavior:

- Dependencies declared in `Cargo.toml` use semver ranges (`^1.2.0`
  resolves to any 1.x). The `Cargo.lock` pins exact versions, but
  `cargo update` re-resolves within the semver range.
- Crates are pulled from `crates.io` by default. The registry has no
  hard-blocked-list on known-malicious crates; advisory enforcement
  is a separate layer.
- A maintainer-account compromise on a transitive dependency can push
  a malicious version that satisfies your semver range. `cargo build`
  pulls it; tests pass (the malicious code activates only in
  production environments); the supply-chain attack ships.

The defense is to consult the RustSec Advisory Database at every
dependency update, with CI enforcement that blocks merges on
advisory matches.

---

## Pattern 1 -- `cargo audit` in CI on every PR

```yaml
# .github/workflows/security-audit.yml
name: Security Audit

on:
  pull_request:
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/security-audit.yml'
  push:
    branches: [main]
  schedule:
    - cron: '0 9 * * 1'  # weekly Monday 09:00 UTC, catches new advisories on existing deps

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Pin to a full commit SHA (AST08 defense on the auditor action
      # itself); the trailing tag comment is for humans.
      - uses: rustsec/audit-check@<full-commit-sha>  # v2.x
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
```

The `audit-check` action reads `Cargo.lock`, consults the RustSec
database, and fails the workflow on any matching advisory. The
weekly cron catches advisories published AFTER a dependency was
last touched -- a crate you depend on may be safe today and flagged
tomorrow.

For direct `cargo audit` invocation without the action:

```bash
cargo install cargo-audit --locked
cargo audit --deny warnings
```

`--deny warnings` upgrades warning-level findings to errors;
appropriate for CI gates where the policy is "block on any finding".

---

## Pattern 2 -- `cargo-deny` for license + source + ban-list enforcement

`cargo-deny` extends `cargo audit` with three additional dimensions:

```toml
# deny.toml
# Field names follow current cargo-deny; regenerate with `cargo deny init`
# when upgrading, since the config schema has changed across releases.
[advisories]
db-urls = ["https://github.com/RustSec/advisory-db"]
unmaintained = "all"   # scope: "all" | "workspace" | "transitive" | "none"
unsound = "all"
yanked = "deny"

[licenses]
# Allow-list only: any license not listed here is denied.
allow = ["MIT", "Apache-2.0", "BSD-3-Clause", "ISC"]

[bans]
multiple-versions = "warn"
deny = [
  { name = "openssl", version = "*" },  # if you've standardised on rustls
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
```

Run via `cargo deny check`. Wire into the same CI workflow as
`cargo audit`; the two checks are complementary rather than

From MILTONADINA/DevOPs, MIT.

More from MILTONADINA/DevOPs