samiandClaude Opus 5.5
e19370f261
- Device key (DeviceSigner): Windows TPM via CNG with a DPAPI-sealed software fallback, Linux Secret Service with a 0600 file fallback (warned in Settings), macOS keychain for dev runs. The store used is recorded; no silent switching. - SyncService (Tauri-free): server URL and pins, create account with the server's setup code, sync after unlock/save/browser save, every 15 min while unlocked and on demand, status events, integrity alarm, device list with fingerprint approval and revoke. - Onboarding: "Use my phone" (join_start/poll, QR rendered locally, 6-digit code), Emergency Kit from PDF/PNG/JPEG (hayro + rqrr), paste setup code, new account. Then only the master password. - From a signed-in desktop: "Add a phone or tablet" QR with countdown (cancel, lock and quit revoke the ticket) and "Approve a computer" via pasted join code. - KESTROVE_DATA_DIR / KESTROVE_DEVICE_NAME for a second instance; ignored live test drives three instances against a real server. - deny: ignore three unmaintained notices for zbus 5 sub-crates (Linux keyring). Co-Authored-By: Claude Opus 5.5 <[email protected]>
37 lines
1.9 KiB
TOML
37 lines
1.9 KiB
TOML
# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories. Mirrors kestrove-core/deny.toml.
|
|
# Not run by `npm audit`: covers only the Rust side (src-tauri).
|
|
[advisories]
|
|
version = 2
|
|
yanked = "deny"
|
|
ignore = [
|
|
# Unmaintained notices (no known vulnerability) for build-time proc-macro crates we can't replace
|
|
# without upgrading upstream: uniffi 0.28 (through kv-ffi) and gtk-rs glib-macros 0.18 (Tauri on Linux).
|
|
{ id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
|
|
{ id = "RUSTSEC-2024-0436", reason = "paste via uniffi 0.28 (proc-macro)" },
|
|
{ id = "RUSTSEC-2024-0370", reason = "proc-macro-error via glib-macros 0.18 / Tauri gtk stack (proc-macro)" },
|
|
# zbus 5 sub-crates folded into zbus 6 (no vulnerability). Linux only: keyring's Secret Service store
|
|
# (device key) still uses zbus 5; revisit when secret-service moves to zbus 6.
|
|
{ id = "RUSTSEC-2026-0370", reason = "zvariant via zbus 5 (keyring Secret Service store, Linux)" },
|
|
{ id = "RUSTSEC-2026-0371", reason = "zbus_names via zbus 5 (keyring Secret Service store, Linux)" },
|
|
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive via zbus 5 (keyring Secret Service store, Linux)" },
|
|
]
|
|
|
|
[licenses]
|
|
version = 2
|
|
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0",
|
|
# clipboard-win / error-code (arboard on Windows): Boost Software License, permissive.
|
|
"BSL-1.0",
|
|
# webpki-roots (Mozilla's CA bundle, via kv-ffi's TLS): permissive data license.
|
|
"CDLA-Permissive-2.0"]
|
|
confidence-threshold = 0.9
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
wildcards = "deny"
|
|
# kv-ffi is a path dependency on ../../kestrove-core without a version; this crate is never published.
|
|
allow-wildcard-paths = true
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|