1988784 - Vet app-services crates

Status: RESOLVED FIXED

(Firefox Build System :: General, enhancement, P2)

Description

[Ben Dean-Kawamura [:bdk]]

The mono-repo work has been making progress and that means the last ./mach vendor is close to working without the --force flag. However, to make it work we're going to need to vet a few more Rust crates used by app-services.

safe-to-deploy (dependencies we'll ship)

• canonical_json: Used by remote_settings for signature checking

safe-to-run (dependencies we'll use for testing)

• mockito: used to create mock HTTP servers for testing
• mockall: used to mock Rust traits for testing. This brings is several subdependencies:
  fragile, predicates, predicates-code, predicates-tree, termtree
• expect-test: used to auto-create and update expected values for testing. Brings in the
  dissimilar subdependency.

Comment 1

[Ben Dean-Kawamura [:bdk]]

If we match our versions to google, we can use their audits and avoid having to vet them:

cargo update -p fragile --precise 2.0.0
cargo update -p predicates --precise 3.0.4
cargo update -p predicates-core --precise 1.0.6
cargo update -p predicates-tree --precise 1.0.9

Comment 2

[Ben Dean-Kawamura [:bdk]]

Attachment: Bug 1988784 - Vet app-services crates, r=supply-chain-reviewers

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/800cf092f1ff
https://hg.mozilla.org/integration/autoland/rev/5ed4f1507b17
Vet app-services crates, r=supply-chain-reviewers

Comment 4

[Ben Dean-Kawamura [:bdk]]

Attachment: Bug 1988784 - One more app-services dependency vet, r=supply-chain-reviewers

I didn't think we'd need this one when I pushed out the first round of
these, but now I realize we do.

Comment 5

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/5ed4f1507b17

Comment 6

[Ben Dean-Kawamura [:bdk]]

Re-opening because there's a second patch that also needs to be merged.

Comment 7

[Ben Dean-Kawamura [:bdk]]

I'm going to mark this one fixed, the remaining audit is handled by https://bugzilla.mozilla.org/show_bug.cgi?id=1979358.