mirror of
https://github.com/chenxiaolong/avbroot.git
synced 2026-07-03 14:05:11 +02:00
Andrew Gunnerson
26a3bafc3d
This prevents avbroot writing to locations where it shouldn't due to manipulation from external processes. For example, replacing the output directory for `avbroot ota extract` with a symlink. Regardless of what symlinks or other changes an external process does to the directory, the cap-std library will use the appropriate `openat2()` options (or equivalent) to prevent writes outside of the directory. Fixes: #166 Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
54 lines
1.1 KiB
TOML
54 lines
1.1 KiB
TOML
[advisories]
|
|
vulnerability = "deny"
|
|
unmaintained = "deny"
|
|
yanked = "deny"
|
|
notice = "deny"
|
|
|
|
[licenses]
|
|
include-dev = true
|
|
unlicensed = "deny"
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"MIT",
|
|
"OpenSSL",
|
|
"Unicode-DFS-2016",
|
|
]
|
|
copyleft = "allow"
|
|
default = "deny"
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [
|
|
{ path = "LICENSE", hash = 0xbd0eed23 },
|
|
]
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
multiple-versions-include-dev = true
|
|
deny = [
|
|
# https://github.com/serde-rs/serde/issues/2538
|
|
{ name = "serde_derive", version = ">=1.0.172,<1.0.184" },
|
|
]
|
|
|
|
[bans.build]
|
|
executables = "deny"
|
|
include-dependencies = true
|
|
include-workspace = true
|
|
bypass = [
|
|
# Copies of unmodified crashwrangler objects for old macOS versions.
|
|
{ name = "honggfuzz", allow-globs = ["honggfuzz/third_party/mac/CrashReport_*.o"] },
|
|
]
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-git = [
|
|
"https://github.com/chenxiaolong/xz2-rs",
|
|
"https://github.com/chenxiaolong/zip",
|
|
"https://github.com/jongiddy/bzip2-rs",
|
|
]
|