diff --git a/docs/security/dependency-policy.md b/docs/security/dependency-policy.md index f7271e68d..dee258441 100644 --- a/docs/security/dependency-policy.md +++ b/docs/security/dependency-policy.md @@ -106,10 +106,10 @@ Current controlled exceptions: - `RUSTSEC-2024-0429` / `GHSA-wrw7-89jp-8q8g` for `glib 0.18.5` is allowed only for the `VariantStrIter` advisory inherited through the Tauri/wry/webkit2gtk/gtk GTK3 stack. A compatible lockfile refresh can move the desktop stack to `tauri 2.11.4`, `wry 0.55.1`, `tao 0.35.3`, `muda 0.19.3`, and related transitive patches, but it still does not move this stack to patched `glib >=0.20.0`; as of 2026-07-11, crates.io metadata for `tauri 2.11.5`, `tauri-runtime-wry 2.11.4`, `wry 0.55.1`, `webkit2gtk 2.0.2`, and `gtk 0.18.2` still keeps Linux on `gtk ^0.18` / `glib ^0.18`. Cargo target-tree evidence shows this Linux GTK stack is absent from the Windows and macOS artifacts BandScope ships. The exception must remain encoded in repo-controlled cargo-audit, OSV, and Trivy configuration, must carry a Trivy expiry/revisit date, is guarded by `scripts/checks/verify_supply_chain.py`, and must be removed when upstream drops or patches the chain. - `RUSTSEC-2026-0194` and `RUSTSEC-2026-0195` for `quick-xml 0.39.4` are allowed only while the current compatible upstream owner chains still require vulnerable `quick-xml`: `plist 1.9.0` through Tauri, and `wayland-scanner 0.31.10` through Linux `rfd`/Wayland dependencies. `quick-xml >=0.41.0` is patched, but `plist 1.9.0` requires `quick-xml ^0.39.2` and the current `wayland-scanner` release also has no compatible patched path. BandScope does not expose either owner chain as a user-controlled XML ingestion surface; the exception must stay encoded in repo-controlled cargo-audit and OSV configuration, and must be removed once compatible upstream crates publish a patched dependency path. -Retired third-party deprecation and advisory signal: +Retired or unresolved third-party deprecation and advisory signal: - `proc-macro-hack v0.5.20+deprecated`, `RUSTSEC-2025-0057` for `fxhash`, and `RUSTSEC-2026-0097` for legacy `rand 0.7.3` were removed by a compatible Tauri lockfile refresh that moved `tauri` to `2.11.0` and `tauri-utils` to `2.9.0`, dropping the `kuchikiki`/`selectors`/`phf 0.8` owner chain. Do not reintroduce this chain or restore the `RUSTSEC-2026-0097` Cargo audit exception; `scripts/checks/verify_supply_chain.py` rejects any future `rand 0.7.x` lockfile entry. -- `GHSA-53q9-r3pm-6pq6` (`torch.load` RCE, fixed in torch 2.6) is allowed only for `torch 2.2.2` in `services/analysis-engine`: torch 2.2.2 is the last release publishing macOS Intel (x86_64) wheels, and the cross-platform build policy mandates macOS Intel + arm64. The vulnerable API only ever loads demucs's pinned model weights (bundled/checksum-tracked per this policy); user-supplied audio never reaches `torch.load`. The exception is encoded in `.github/workflows/dependency-review.yml` (`allow-ghsas`) and `services/analysis-engine/osv-scanner.toml`, and must be removed when the engine migrates off torch (e.g. ONNX runtime) or the Intel-mac mandate changes. +- `GHSA-53q9-r3pm-6pq6` (`torch.load` RCE, fixed in torch 2.6) remains an unresolved `torch 2.2.2` compatibility risk because torch 2.2.2 is the last release publishing macOS Intel (x86_64) wheels and the cross-platform build policy still mandates macOS Intel + arm64. It is **not an active Python vulnerability exception**: the repository-local dependency-review workflow was removed during workflow consolidation, there is no `services/analysis-engine/osv-scanner.toml`, and the retained `security-backstop` runs `pip-audit --local --strict` without a targeted ignore. A future audit that reports this advisory must therefore fail closed rather than rely on stale exception prose. Protected `develop` currently resolves `htdemucs` through upstream `get_model`, whose first load can acquire weights, and the Demucs checkpoint path reaches the code-bearing `torch.load` serialization boundary. Draft #970 narrows compatibility loading to an already-present, bounded, checksum-prefix-validated local checkpoint snapshot with remote resolution disabled, but Draft behavior is not protected or released truth. #1180 owns the immutable full-digest/signature/provenance and safer serialization contract, while #1181 independently blocks upstream pretrained-weight commercial use/redistribution absent an explicit grant. Remove the vulnerable dependency path by moving to a patched or materially narrower loader/runtime, or retire the Intel-mac requirement; until then, release readiness remains fail closed on the model-artifact, security, and rights prerequisites. - Yanked `fastrand 2.4.0` was transiently inherited through target-specific `wry`/`dom_query` HTML parsing dependencies and must stay updated to `2.4.1` or newer in `apps/desktop/src-tauri/Cargo.lock`; `scripts/checks/verify_supply_chain.py` guards against reintroducing the yanked version. ## Required checks intent diff --git a/services/analysis-engine/tests/test_supply_chain_policy.py b/services/analysis-engine/tests/test_supply_chain_policy.py index 1d8224c5a..6a0853944 100644 --- a/services/analysis-engine/tests/test_supply_chain_policy.py +++ b/services/analysis-engine/tests/test_supply_chain_policy.py @@ -1275,9 +1275,7 @@ def test_workflow_concurrency_cancels_only_superseded_pr_heads() -> None: workflow = (workflows_dir / workflow_name).read_text(encoding="utf-8") assert "concurrency:" in workflow, workflow_name assert "cancel-in-progress: false" in workflow, workflow_name - assert "contents: read" in workflow or "permissions: read-all" in workflow, ( - workflow_name - ) + assert "contents: read" in workflow or "permissions: read-all" in workflow, workflow_name assert "pull_request:" not in (workflows_dir / "release.yml").read_text(encoding="utf-8") diff --git a/supply-chain/supplemental-component-inventory.json b/supply-chain/supplemental-component-inventory.json index 784d90d57..10b196179 100644 --- a/supply-chain/supplemental-component-inventory.json +++ b/supply-chain/supplemental-component-inventory.json @@ -19,8 +19,8 @@ "license": "Proprietary", "checksum": "sha256:ced4ae5c9077aace1694b6fafee1877e46e836e293545dcb6ea06cb579984254", "storagePath": "services/analysis-engine/src/bandscope_analysis/separation/model_weights/bandsplit-v1.json", - "releaseUsage": "Local-first lightweight profile used by analysis-engine stem separation.", - "verification": "SHA256 verified in bandscope_analysis.separation.audio_separator.AudioStemSeparator._load_model_profile" + "releaseUsage": "Tracked repository profile; the current runtime separation path does not consume it.", + "verification": "SHA256 is recorded here; runtime checksum verification is not currently implemented." } ], "notes": [