Mk/Uses/cargo.mk: Add support for security/cargo-audit

[tobik]

Summary

security/cargo-audit [1] can be used to check Cargo.lock files for vulnerable crates. I thought it might be nice to add support for it to cargo.mk.

It adds a new cargo-audit target that just checks the crates from CARGO_CRATES. Since this is incomplete (e.g., due to local crates from GH_TUPLE or similar that will never be in CARGO_CRATES) it also runs cargo-audit after the build when there is a complete Cargo.lock.

[1] https://rustsec.org/

[mat]

Mk/Uses/cargo.mk

264–275

I think this should be in Mk/Scripts/qa.sh.

Also, maybe whatever provides ${LOCALBASE}/bin/cargo-audit should be added to BUILD_DEPENDS when DEVELOPER is set.

265–266

Should this be called something else? its being named "post-build" is confusing when it is in the install/stage phase.

[tobik]

• Use qa.sh
• Add cargo-audit to BUILD_DEPENDS
• Also add --force to cargo install to allow cargo to overwrite already staged binaries for painless restaging

[tobik]

Mk/Uses/cargo.mk

265–266

Probably. I was flip-flopping between hooking this up to just after building (which would actually be far enough) and after staging.

[tobik]

Mk/bsd.port.mk

1644–1661 ↗

(On Diff #48830)

Why does this happen in bsd.port.mk instead of the individual USES?

[tobik]

This requires way more thought.

cargo-audit opens a network connection to fetch a database of vulnerable crates which obviously isn't allowed in Poudriere, so qa.sh integration is probably not possible in a good way.

[mat]

In D17448#372255, @tobik wrote:

This requires way more thought.

cargo-audit opens a network connection to fetch a database of vulnerable crates which obviously isn't allowed in Poudriere, so qa.sh integration is probably not possible in a good way.

Mmmm, maybe the db could be fetched during fetch and used later?

Mk/Uses/cargo.mk

67

Could you make that .cargo-home so that it stays hidden?

[tobik]

• Hide CARGO_HOME
• As a PoC apply some messy hacks to cargo-audit to add an offline, fetch-only mode, and to allow it to load the advisory database from a regular directory
• Add CARGO_DISABLE_AUDIT knob to turn the qa check off. This is nice to have but also necessary for security/cargo-audit as it cannot depend on itself.
• Add security/rustsec-advisory-db port that serves as a way to fetch the database in a Poudriere compatible way

Poudriere does not seem to set DEVELOPER{,_MODE} (or another knob
that identifies that we are in port testing mode) when calculating which
dependencies it needs, so unfortunately POUDRIERE_CARGO_AUDIT_WORKAROUND
currently has to be set in make.conf for this to even work.

[tobik]

• Cleanup cargo-audit target a bit

[mat]

If the only consumer of CARGO_DISABLE_AUDIT is security/cargo-audit, then it should probably be better to test something like .if ${PKGORIGIN} != security/cargo-audit instead of adding a new variable only used once in the whole ports tree.

Mk/Scripts/qa.sh

947 ↗

(On Diff #48849)

I do not think you need a second variable, you could add a -x "${LOCALBASE...".

951–953 ↗

(On Diff #48849)

I think I remember you saying this can exit with a non 0 status, I think it should be trapped with, for example, || :.

Mk/Uses/cargo.mk

47–50

The only variable is DEVELOPER, there is no DEVELOPER_MODE.

[tobik]

Mk/Uses/cargo.mk

47–50

Poudriere sets DEVELOPER_MODE=yes in port testing mode consistently, but AFAICT it only sets DEVELOPER=1 during check-sanity, stage-qa, check-plist.

This was useful in a previous iteration when I was still adding cargo-audit to FETCH_DEPENDS with a custom fetch target to grab the advisory db with cargo-audit --fetch_only.

It can definitely go away now though.

[tobik]

It's not going to happen in a good way, so burying this idea.