- Depend on provides of rust to allow older compiler version usage
- Update to version 0.6.4~0: * Release cargo-auditable v0.6.4 * Correctly attribute changelog file addition in changelog * Add changelog for auditable-extract * Verify various feature combinations in CI * Upgrade wasmparser to remove dependencies with `unsafe` * Add LoongArch support * cargo fmt * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages * Expand on the note about WebAssembly parsing * Populate changelogs * Resume bragging about all dependencies being safe, now that there is a caveat below * drop fuzz Cargo.lock to always fuzz against latest versions * Bump `cargo auditable` version * Mention WASM support in README * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI" * Be super duper extra sure both MinGW and MSVC are tested on CI * Add wasm32 targets to CI for more platforms * Don't pass --target twice in tests * Install WASM toolchain in CI * cargo fmt * Add WASM end-to-end test * cargo fmt * Update documentation to mention the WASM feature * cargo fmt * Plumb WASM parsing feature through the whole stack * Make WASM parsing an optional, non-default feature * Add a fuzzing harness for WASM parsing OBS-URL: https://build.opensuse.org/package/show/devel:languages:rust/cargo-auditable?expand=0&rev=7
This commit is contained in:
William Brown
Git OBS Bridge
commit
cd88031c04
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
.osc
|
||||
27
_service
Normal file
27
_service
Normal file
@ -0,0 +1,27 @@
|
||||
<services>
|
||||
<service mode="manual" name="obs_scm">
|
||||
<param name="url">https://github.com/rust-secure-code/cargo-auditable.git</param>
|
||||
<param name="versionformat">@PARENT_TAG@~@TAG_OFFSET@</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">v0.6.4</param>
|
||||
<param name="match-tag">v*</param>
|
||||
<param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param>
|
||||
<param name="versionrewrite-replacement">\1</param>
|
||||
<param name="changesgenerate">enable</param>
|
||||
<param name="changesauthor">william.brown@suse.com</param>
|
||||
</service>
|
||||
<service mode="manual" name="tar" />
|
||||
<service mode="manual" name="recompress">
|
||||
<param name="file">*.tar</param>
|
||||
<param name="compression">zst</param>
|
||||
</service>
|
||||
<service mode="manual" name="set_version"/>
|
||||
<service name="cargo_vendor" mode="manual">
|
||||
<param name="srcdir">cargo-auditable</param>
|
||||
<param name="compression">zst</param>
|
||||
<param name="update">true</param>
|
||||
</service>
|
||||
<service name="cargo_audit" mode="manual">
|
||||
<param name="srcdir">cargo-auditable</param>
|
||||
</service>
|
||||
</services>
|
||||
4
_servicedata
Normal file
4
_servicedata
Normal file
@ -0,0 +1,4 @@
|
||||
<servicedata>
|
||||
<service name="tar_scm">
|
||||
<param name="url">https://github.com/rust-secure-code/cargo-auditable.git</param>
|
||||
<param name="changesrevision">a0ed9cb5b98a0c927fa8d78aed04065144b136e7</param></service></servicedata>
|
||||
3
cargo-auditable-0.6.2~0.obscpio
Normal file
3
cargo-auditable-0.6.2~0.obscpio
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:b8c6b404b4841bc278f5a7712a12897a0fe3cae6187b1c46bd26be071478a496
|
||||
size 211979
|
||||
3
cargo-auditable-0.6.2~0.tar.zst
Normal file
3
cargo-auditable-0.6.2~0.tar.zst
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:834ecaa076b10f08af899de7d07630ed0517b08296a73dcc4e030e4c47047564
|
||||
size 46049
|
||||
3
cargo-auditable-0.6.4~0.tar.zst
Normal file
3
cargo-auditable-0.6.4~0.tar.zst
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:2f6f8a3116e4d270f6a7ef52b4ae299f15fe7f2c3e00daf454974a038ff56f56
|
||||
size 55478
|
||||
156
cargo-auditable.changes
Normal file
156
cargo-auditable.changes
Normal file
@ -0,0 +1,156 @@
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 19 02:02:31 UTC 2024 - William Brown <william.brown@suse.com>
|
||||
|
||||
- Depend on provides of rust to allow older compiler version usage
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue May 28 04:48:14 UTC 2024 - william.brown@suse.com
|
||||
|
||||
- Update to version 0.6.4~0:
|
||||
* Release cargo-auditable v0.6.4
|
||||
* Correctly attribute changelog file addition in changelog
|
||||
* Add changelog for auditable-extract
|
||||
* Verify various feature combinations in CI
|
||||
* Upgrade wasmparser to remove dependencies with `unsafe`
|
||||
* Add LoongArch support
|
||||
* cargo fmt
|
||||
* Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
|
||||
* Expand on the note about WebAssembly parsing
|
||||
* Populate changelogs
|
||||
* Resume bragging about all dependencies being safe, now that there is a caveat below
|
||||
* drop fuzz Cargo.lock to always fuzz against latest versions
|
||||
* Bump `cargo auditable` version
|
||||
* Mention WASM support in README
|
||||
* Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
|
||||
* Be super duper extra sure both MinGW and MSVC are tested on CI
|
||||
* Add wasm32 targets to CI for more platforms
|
||||
* Don't pass --target twice in tests
|
||||
* Install WASM toolchain in CI
|
||||
* cargo fmt
|
||||
* Add WASM end-to-end test
|
||||
* cargo fmt
|
||||
* Update documentation to mention the WASM feature
|
||||
* cargo fmt
|
||||
* Plumb WASM parsing feature through the whole stack
|
||||
* Make WASM parsing an optional, non-default feature
|
||||
* Add a fuzzing harness for WASM parsing
|
||||
* Rewritten WASM parsing to avoid heap allocations
|
||||
* Initial WASM extraction support
|
||||
* Nicer assertion
|
||||
* Drop obsolete comment
|
||||
* Clarify that embedding the compiler version has shipped.
|
||||
* Fixed section name for WASM
|
||||
* Unified and more robust platform detection. Fixed wasm build process
|
||||
* Initial WASM support
|
||||
* More robust platform detection for picking the binary format
|
||||
* Fix Windows CI to run both -msvc and -gnu
|
||||
* Use the correct link.exe flag for preserving the specified symbol even if it is unused
|
||||
* Fix Windows
|
||||
* Fix tests on Rust 1.77
|
||||
* Placate clippy
|
||||
* Oopps, I meant components field
|
||||
* Also remove the dependencies field if empty
|
||||
* Use serde_json with order preservation feature to get a more compressible JSON after workarounds
|
||||
* Work around cyclonedx-bom limitations to produce minified JSON
|
||||
* Also record the dependency kind
|
||||
* cyclonedx-bom: also record PURL
|
||||
* Also write the dependency tree
|
||||
* Clear the serial number in the minimal CycloneDX variant
|
||||
* Prototype impl of auditable2cdx
|
||||
* Fill in auditable2cdx dependencies
|
||||
* Initial auditable2cdx boilerplace
|
||||
* add #![forbid(unsafe_code)]
|
||||
* Initial implementation of auditable-to-cyclonedx conversion
|
||||
* Add the necessary dependencies to auditable-cyclonedx
|
||||
* Initial dummy package for auditable-cyclonedx
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Mar 5 01:17:29 UTC 2024 - Soc Virnyl Estela <uncomfy+openbuildservice@uncomfyhalomacro.pl>
|
||||
|
||||
- Update specfile:
|
||||
* remove cargo_config file
|
||||
- Update service file:
|
||||
* replace obsoleted "disabled" mode with "manual"
|
||||
- Update to version 0.6.2~0:
|
||||
* Update the lockfile
|
||||
* New releases of cargo-auditable and auditable-serde
|
||||
* Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
|
||||
* Revert "add commit hashes to git sources"
|
||||
* Fix cyclic dependency graph being encoded
|
||||
* Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
|
||||
* An unsuccessful attempt to fix cycles caused by dev-dependencies
|
||||
* Fix typo
|
||||
* Add comment
|
||||
* Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
|
||||
* Fix auditable-serde example not building
|
||||
* upgrade dependency miniz_oxide to 0.6.0
|
||||
* fix formatting errors
|
||||
* apply clippy lints for --all-features
|
||||
* improve the internal docs and comments
|
||||
* apply clippy lints
|
||||
* add missing sources for one of test fixtures
|
||||
* add commit hashes to git sources
|
||||
* Run all tests on CI
|
||||
* cargo fmt
|
||||
* Run `cargo clean` in tests to get rid of stale binaries
|
||||
* Fix date in changelog
|
||||
* Populate changelog
|
||||
* Bump auditable-info version in rust-audit-info
|
||||
* Add auditable-info changelog
|
||||
* Bump versions following cargo-lock bump
|
||||
* auditable-serde: bump `cargo-lock` to v9
|
||||
* switch to UNRELEASED
|
||||
* Update CHANGELOG.md
|
||||
* Print a better error if calling rustc fails
|
||||
* Drop unused import
|
||||
* placate Clippy
|
||||
* Don't inject audit info if --print argument is passed to rustc
|
||||
* Reflect the version change in Cargo.lock
|
||||
* Remove space from keywords
|
||||
* bump version to 0.6.1
|
||||
* Fix date in changelog
|
||||
* Update CHANGELOG.md
|
||||
* Add publish=false
|
||||
* Commit the generated manpage
|
||||
* Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
|
||||
* Explain relation to supply chain attacks
|
||||
* Add keywords to the Cargo manifest
|
||||
* Revert "generate a man page for cargo auditable"
|
||||
* fix formatting
|
||||
* fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
|
||||
* generate a man page for cargo auditable
|
||||
* Add Clippy suppression
|
||||
* placate clippy
|
||||
* commit Cargo.lock
|
||||
* Sync to latest object file writing code from rustc
|
||||
* Fix examples in docs
|
||||
* Allow redundant field names
|
||||
* Apply clippy suggestion: match -> if let
|
||||
* Check for clippy and format in CI
|
||||
* Apply clippy suggestions
|
||||
* Run CI with --locked
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 23 14:27:09 UTC 2023 - Andrea Manzini <andrea.manzini@suse.com>
|
||||
|
||||
- Update to version 0.6.0~0:
|
||||
* README and documentation improvements
|
||||
* Read the rustc path passed by Cargo; fixes #90
|
||||
* Read location of Cargo from the environment variable Cargo sets for third-party subcommands
|
||||
* Add a note on sccache version compatibility to CHANGELOG.md
|
||||
* Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
|
||||
* Specifying the binary-scanning feature is no longer needed
|
||||
* Pass options such as --offline to `cargo metadata`
|
||||
* Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
|
||||
* Bump rust-audit-info to 0.5.2
|
||||
* Bump auditable-serde version to 0.5.2
|
||||
* Correctly fill in the source even in dependency entries when converting to cargo-lock data format
|
||||
* Drop the roundtrip through &str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
|
||||
* Release auditable-info 0.6.1
|
||||
* Bump all the version requirements for things depending on auditable-info
|
||||
* Fix audit_info_from_slice function signature
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 3 04:31:16 UTC 2022 - William Brown <william.brown@suse.com>
|
||||
|
||||
- Initial commit
|
||||
4
cargo-auditable.obsinfo
Normal file
4
cargo-auditable.obsinfo
Normal file
@ -0,0 +1,4 @@
|
||||
name: cargo-auditable
|
||||
version: 0.6.4~0
|
||||
mtime: 1715183073
|
||||
commit: a0ed9cb5b98a0c927fa8d78aed04065144b136e7
|
||||
64
cargo-auditable.spec
Normal file
64
cargo-auditable.spec
Normal file
@ -0,0 +1,64 @@
|
||||
#
|
||||
# spec file for package cargo-auditable
|
||||
#
|
||||
# Copyright (c) 2024 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
# upon. The license for this file, and modifications and additions to the
|
||||
# file, is the same license as for the pristine package itself (unless the
|
||||
# license for the pristine package is not an Open Source License, in which
|
||||
# case the license is the MIT License). An "Open Source License" is a
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
%define __rustflags -Clink-arg=-Wl,-z,relro,-z,now -C debuginfo=2 -C incremental=false
|
||||
%define __cargo CARGO_FEATURE_VENDORED=1 RUSTFLAGS="%{__rustflags}" %{_bindir}/cargo
|
||||
%define __cargo_common_opts %{?_smp_mflags}
|
||||
|
||||
Name: cargo-auditable
|
||||
Version: 0.6.4~0
|
||||
Release: 0
|
||||
Summary: A tool to embed auditing information in ELF sections of rust binaries
|
||||
# If you know the license, put it's SPDX string here.
|
||||
# Alternately, you can use cargo lock2rpmprovides to help generate this.
|
||||
License: (Apache-2.0 OR MIT) AND Unicode-DFS-2016 AND (0BSD OR MIT OR Apache-2.0) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 OR MIT OR Zlib) AND (MIT OR Unlicense) AND (Apache-2.0 OR Zlib OR MIT) AND MIT
|
||||
# Select a group from this link:
|
||||
# https://en.opensuse.org/openSUSE:Package_group_guidelines
|
||||
Group: Development/Languages/Rust
|
||||
URL: https://github.com/rust-secure-code/cargo-auditable
|
||||
Source0: %{name}-%{version}.tar.zst
|
||||
Source1: vendor.tar.zst
|
||||
# We can't dep on cargo-packaging because we would create a dependency loop.
|
||||
# BuildRequires: cargo-packaging
|
||||
BuildRequires: rust+cargo
|
||||
BuildRequires: zstd
|
||||
Requires: rust+cargo
|
||||
|
||||
%description
|
||||
Know the exact crate versions used to build your Rust executable. Audit binaries for known bugs or
|
||||
security vulnerabilities in production, at scale, with zero bookkeeping. This works by embedding
|
||||
data about the dependency tree in JSON format into a dedicated linker section of the compiled
|
||||
executable.
|
||||
|
||||
%prep
|
||||
%autosetup -a1
|
||||
|
||||
%build
|
||||
unset LIBSSH2_SYS_USE_PKG_CONFIG
|
||||
%{__cargo} build \
|
||||
%{__cargo_common_opts} \
|
||||
--offline --release
|
||||
|
||||
%install
|
||||
install -D -d -m 0755 %{buildroot}%{_bindir}
|
||||
install -m 0755 %{_builddir}/%{name}-%{version}/target/release/cargo-auditable %{buildroot}%{_bindir}/cargo-auditable
|
||||
|
||||
%files
|
||||
%{_bindir}/cargo-auditable
|
||||
|
||||
%changelog
|
||||
3
vendor.tar.zst
Normal file
3
vendor.tar.zst
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:76dd589706de37d7fc330d29b6867ebe09169f1dca666523b3459b25041cb91c
|
||||
size 10514792
|
||||
Loading…
x
Reference in New Issue
Block a user