From a261533e693318ee0cbb64adf6ec8b2935c17836 Mon Sep 17 00:00:00 2001 From: Gaurav Jadhav Date: Fri, 16 Oct 2026 09:51:42 +0530 Subject: [PATCH] Replace deprecated serde_yaml with serde-saphyr in compiletest serde_yaml is deprecated and pulls in the unmaintained unsafe-libyaml (RUSTSEC-2024-0449). Parse the exec-mode config.yml with serde-saphyr instead and drop the matching deny.toml advisory ignore. encoding_rs (BSD-3-Clause, via serde-saphyr) gets a license exception since compiletest is not shipped. Resolves #5000 Signed-off-by: Gaurav Jadhav --- Cargo.lock | 92 +++++++++++++++++++++++++------- deny.toml | 6 +-- tools/compiletest/Cargo.toml | 2 +- tools/compiletest/src/runtest.rs | 2 +- 4 files changed, 77 insertions(+), 25 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 61deb5650134..48097a5687fd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -133,6 +133,12 @@ dependencies = [ "object", ] +[[package]] +name = "arraydeque" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236" + [[package]] name = "assert_cmd" version = "2.2.2" @@ -428,8 +434,8 @@ dependencies = [ "glob", "libc", "serde", + "serde-saphyr", "serde_json", - "serde_yaml", "tracing", "tracing-subscriber", "wait-timeout", @@ -469,6 +475,12 @@ version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" +[[package]] +name = "core_detect" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48" + [[package]] name = "cprover_bindings" version = "0.68.0" @@ -735,6 +747,29 @@ version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0" +[[package]] +name = "encoding_rs" +version = "0.8.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679" +dependencies = [ + "cfg-if", + "core_detect", + "multiversion_no_op", + "rustversion", + "scopeguard", + "simdutf8", +] + +[[package]] +name = "encoding_rs_io" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22" +dependencies = [ + "encoding_rs", +] + [[package]] name = "env_filter" version = "2.0.0" @@ -917,6 +952,16 @@ version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b" +[[package]] +name = "granit-parser" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da55feca5d1625466bae068f9fd4b87892caeae70c3fe671ddb0f50d41aebf37" +dependencies = [ + "arraydeque", + "smallvec", +] + [[package]] name = "graph-cycles" version = "0.3.0" @@ -1374,6 +1419,12 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "multiversion_no_op" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d" + [[package]] name = "nix" version = "0.31.3" @@ -2005,6 +2056,20 @@ dependencies = [ "serde_derive", ] +[[package]] +name = "serde-saphyr" +version = "2.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a253edfdea34032da21af84e16fcc94f4c7a6ba237f9f3bc2dbf43cea8535c44" +dependencies = [ + "annotate-snippets", + "encoding_rs_io", + "granit-parser", + "num-traits", + "serde_core", + "smallvec", +] + [[package]] name = "serde_core" version = "1.0.229" @@ -2099,19 +2164,6 @@ dependencies = [ "serde", ] -[[package]] -name = "serde_yaml" -version = "0.9.34+deprecated" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" -dependencies = [ - "indexmap", - "itoa", - "ryu", - "serde", - "unsafe-libyaml", -] - [[package]] name = "sha1" version = "0.10.7" @@ -2158,6 +2210,12 @@ dependencies = [ "libc", ] +[[package]] +name = "simdutf8" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e" + [[package]] name = "slab" version = "0.4.12" @@ -2645,12 +2703,6 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3" -[[package]] -name = "unsafe-libyaml" -version = "0.2.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" - [[package]] name = "ustr" version = "1.1.0" diff --git a/deny.toml b/deny.toml index 7661eacdae5f..03dde6fa0974 100644 --- a/deny.toml +++ b/deny.toml @@ -14,9 +14,6 @@ ignore = [ # `llbc` feature and not part of Kani releases. { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; only reached via charon" }, { id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is unmaintained; only reached via charon" }, - # Unmaintained (not vulnerable): `unsafe-libyaml` is only reached through `serde_yaml` in - # compiletest, our test runner, which is not part of Kani releases. - { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is unmaintained; only reached via serde_yaml in compiletest" }, ] # This section is considered when running `cargo deny check licenses` @@ -36,6 +33,9 @@ exceptions = [ { name = "foldhash", allow=["Zlib"] }, # Transitive dependencies via charon (LLBC backend) { name = "ustr", allow=["BSD-2-Clause-Patent"] }, + # Transitive dependency of serde-saphyr in compiletest, our test runner, which is not part of + # Kani releases. + { name = "encoding_rs", allow=["BSD-3-Clause"] }, ] [licenses.private] diff --git a/tools/compiletest/Cargo.toml b/tools/compiletest/Cargo.toml index 25cc4c91aa7e..6ca2c0c8561b 100644 --- a/tools/compiletest/Cargo.toml +++ b/tools/compiletest/Cargo.toml @@ -22,7 +22,7 @@ tracing = "0.1" tracing-subscriber = { version = "0.3.20", default-features = false, features = ["fmt", "env-filter", "smallvec", "parking_lot", "ansi"] } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" -serde_yaml = "0.9" +serde-saphyr = { version = "2.0", default-features = false, features = ["deserialize"] } walkdir = "2" glob = "0.3" wait-timeout = "0.2.0" diff --git a/tools/compiletest/src/runtest.rs b/tools/compiletest/src/runtest.rs index 82526b5d3e45..4438547071f5 100644 --- a/tools/compiletest/src/runtest.rs +++ b/tools/compiletest/src/runtest.rs @@ -423,7 +423,7 @@ impl TestCx<'_> { // Open the `config.yml` file and extract its values let path_yml = self.testpaths.file.join("config.yml"); let config_file = std::fs::File::open(path_yml).expect("couldn't open `config.yml`"); - let exec_config_res = serde_yaml::from_reader(config_file); + let exec_config_res = serde_saphyr::from_reader(config_file); if let Err(error) = &exec_config_res { let err_msg = format!("couldn't parse `config.yml` file: {error}"); fatal_error(&err_msg);