From 71e46a1ea61593f3835363d43a2e19318195dd1a Mon Sep 17 00:00:00 2001
From: kingchenc <kingchencp@gmail.com>
Date: Fri, 22 May 2026 16:25:58 +0200
Subject: [PATCH] E10: add cargo-deny supply-chain checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The repository had no supply-chain auditing — no deny.toml and no CI
job to catch vulnerable, unmaintained, wrongly-licensed, or
unexpectedly-sourced dependencies.

Add deny.toml covering advisories, bans, licenses and sources:

- licenses: an allow-list of the permissive licenses the dependency
  tree actually uses, plus the workspace's own PolyForm-Noncommercial
  license and a scoped LLVM-exception for target-lexicon.
- bans: warn on duplicate versions, deny external wildcard deps
  (internal path deps are allowed).
- sources: only crates.io.
- advisories: RUSTSEC-2025-0020 (pyo3 0.22) is ignored with a documented
  reason — it is reachable only through bindings/python and the pyo3
  upgrade is tracked separately; the published crates do not use pyo3.

Add a `supply-chain` CI job running cargo-deny-action (SHA-pinned).
`cargo deny check` passes locally: advisories/bans/licenses/sources ok.
---
 .github/workflows/ci.yml | 13 +++++++++
 deny.toml                | 57 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 deny.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14c9c0b9..c1b17481 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,6 +86,19 @@ jobs:
       - name: Test on MSRV
         run: cargo test ${{ matrix.packages }} --verbose
 
+  # Supply-chain audit: security advisories, license policy, banned crates,
+  # and source restrictions. Configured by deny.toml at the repo root.
+  supply-chain:
+    name: Supply-chain (cargo-deny)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: cargo-deny
+        uses: EmbarkStudios/cargo-deny-action@a531616d8ce3b9177443e48a1159bc945a099823 # v2.0.19
+        with:
+          command: check
+
   python:
     name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..c5440c8a
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,57 @@
+# cargo-deny configuration — supply-chain checks for the Wickra workspace.
+# Run locally with `cargo deny check`; CI runs the same in the `supply-chain`
+# job (see .github/workflows/ci.yml).
+
+[graph]
+all-features = true
+
+[advisories]
+# Fail on any security advisory or unmaintained/unsound crate in the tree.
+version = 2
+yanked = "deny"
+ignore = [
+    # RUSTSEC-2025-0020 — PyString::from_object buffer overflow in pyo3 0.22.
+    # Reached only through the python binding (numpy 0.22 -> pyo3 0.22). The
+    # fix requires upgrading pyo3 to >=0.24.1, which also forces a numpy
+    # upgrade and a Bound-API migration of bindings/python — a separate,
+    # tracked piece of work. The published Rust crates and the Node/WASM
+    # bindings do not depend on pyo3.
+    { id = "RUSTSEC-2025-0020", reason = "pyo3 0.22 upgrade tracked separately; affects only bindings/python" },
+]
+
+[bans]
+# Catch accidental duplicate versions and wildcard ("*") version requirements.
+multiple-versions = "warn"
+wildcards = "deny"
+# Internal workspace crates are referenced by `path` without a version, which
+# is a legitimate wildcard — only flag wildcards on external registry crates.
+allow-wildcard-paths = true
+
+[licenses]
+version = 2
+# Licenses permitted for every crate in the dependency graph. Wickra itself is
+# PolyForm-Noncommercial-1.0.0; the rest are the permissive licenses its
+# dependency tree actually uses.
+allow = [
+    "PolyForm-Noncommercial-1.0.0",
+    "MIT",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "BSL-1.0",
+    "Zlib",
+    "Unlicense",
+]
+# Crates whose SPDX expression carries a license exception (e.g. the LLVM
+# exception on Apache-2.0). The exception is only granted to the named crate.
+exceptions = [
+    { allow = ["Apache-2.0 WITH LLVM-exception"], crate = "target-lexicon" },
+]
+
+[sources]
+# Only the canonical crates.io registry is allowed; no git or alternative
+# registries.
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]