Repository navigation
Ignore new rustls advisories pending FIPS-certified aws-lc-rs - #185
Conversation
cargo-audit fails on RUSTSEC-2026-0346/0348/0349, which are fixed in rustls >= 0.23.46. Every rustls version from 0.23.45 onward requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, still pending FIPS 140-3 certification, so the pinned versions cannot be bumped yet. Each ignored advisory is practically mitigated: the brotli feature is disabled, 0349 only weakens post-quantum confidentiality, and 0346 requires a custom session store that logs Debug output. Ignores are commented with justifications and a removal note.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Co-authored-by: Yiming Luo <10097700+lym953@users.noreply.github.com>
Co-authored-by: Yiming Luo <10097700+lym953@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
Human security review is needed to accept the residual TLS risks while the FIPS dependency constraint remains.
0 open findings
What changed in this PR
Temporarily extends cargo-audit exceptions while the FIPS backend constraint prevents upgrading rustls, continuing the approach from #173.
Changes:
- Adds three advisory ignores alongside RUSTSEC-2026-0285.
- Documents exposure rationale and when to remove the ignores.
| File | Description |
|---|---|
.cargo/audit.toml |
Adds rustls advisory waivers and justification comments. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@DataDog review |
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The lockfile confirms Brotli is absent, supporting the decompression-advisory exception. The audit configuration parses successfully, though cargo-audit execution remains unverified.
🤖 Bits Code Review · Commit 2612ebd
What does this PR do?
Adds RUSTSEC-2026-0346, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 to the cargo-audit ignore list in
.cargo/audit.toml, alongside the existing RUSTSEC-2026-0285 ignore, each with a justification comment.Motivation
cargo-audit started failing CI on three new rustls advisories (all published 2026-10-14, all fixed in rustls >= 0.23.46):
brotlifeature is not enabled (default-features = falseincrates/datadog-fips).Debugimpls expose TLS session secrets): only affects customClientSessionStoreimplementations that logDebugoutput.The fixed rustls 0.23.46 cannot be taken: every rustls version from 0.23.45 onward requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, still pending FIPS 140-3 certification. This is the same tradeoff already accepted for RUSTSEC-2026-0285 in #173. The ignores carry a removal note once a FIPS-certified aws-lc-rs is available.
Additional Notes
mainhas the same exposure (rustls 0.23.44 < 0.23.46), so its Audit job will fail on these advisories too until this lands.Describe how to test/QA your changes
cargo audit --file Cargo.lockpasses locally with only the two allowed informational warnings (unmaintainedunsafe-libyaml, unsoundlru). CI's Audit job should go green.