2043313 - mach vendor and cargo-vet fails: "Some non-crates.io-fetched packages match published crates.io versions: zlib-rs"

Status: RESOLVED FIXED

(Developer Infrastructure :: Mach Vendor & Updatebot, defect)

Description

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

> ./mach vendor rust
/Users/krosylight/Documents/dev/firefox/third_party/python/urllib3/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
  warnings.warn(
     Locking 0 packages to latest compatible versions
note: pass `--verbose` to see 266 unchanged dependencies behind latest
 0:15.93 [INFO] Using /Users/krosylight/Documents/dev/firefox/.cargo/config.toml.
 0:24.08 E Vet error: There are some issues with your policy.audit-as-crates-io entries
 0:24.84  related error: Some non-crates.io-fetched packages match published crates.io versions
  zlib-rs:0.6.3
 0:24.84 Run `./mach cargo vet` for more information.
Errors occurred; new rust crates were not vendored.
Sentry is attempting to send 1 pending events
Waiting up to 2 seconds
Press Ctrl-C to quit

The hack in bug 1950764 needs audit-as-crates-io.

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1950764

:glandium, since you are the author of the regressor, bug 1950764, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Attachment: Bug 2043313 - Add audit-as-crates-io for zlib-rs r=#supply-chain-reviewers

Comment 3

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Attachment: Bug 2043313 - Run cargo vet prune r=#supply-chain-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/11f5e70ea22c
https://hg.mozilla.org/integration/autoland/rev/6ae1404029cb
Add audit-as-crates-io for zlib-rs r=supply-chain-reviewers,glandium

Comment 5

[rperta]

https://hg.mozilla.org/mozilla-central/rev/6ae1404029cb

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0b9f85005269
https://hg.mozilla.org/integration/autoland/rev/a6dc78b7fa91
Run cargo vet prune r=supply-chain-reviewers,emilio

Comment 7

[Mike Hommey [:glandium]]

can you request an uplift for the audit-as-crates-io change?

Comment 8

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Done! Should have done it days ago...

Comment 9

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: (non-user but only infrastructure impact) cargo vet will fail on beta branch because of incorrect configuration
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: low
• Explanation of risk level: build-time only change
• String changes made/needed?: N/A
• Is Android affected?: yes

Comment 10

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Attachment: Bug 2043313 - Add audit-as-crates-io for zlib-rs

Original Revision: https://phabricator.services.mozilla.com/D303106

Comment 11

[Goloman Adrian[:agoloman]]

https://hg.mozilla.org/mozilla-central/rev/a6dc78b7fa91

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/d05a339c9ed1
https://hg.mozilla.org/releases/mozilla-beta/rev/f05e0c4209e5