diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index f49cb3515..2d5314cb8 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -3123,7 +3123,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p who = "Lukasz Anforowicz " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.0" -notes = "The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = \"std\")]`." +notes = 'The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = "std")]`.' aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" [[audits.google.audits.equivalent]] @@ -3235,7 +3235,7 @@ who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "0.5.2" notes = """ -Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits except for 3 `unsafe impl bytemuck::SomeTrait for ...`. Each `impl` had a reasonable safety comment and there were no actual `unsafe` blocks, so I think this can be treated as `ub-risk-1`. Additional `unsafe` review comments can be @@ -3689,8 +3689,8 @@ who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "0.19.0" notes = """ -Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits -(except for benign \"fs\" hit in `skrifa-0.19.0/src/color/traversal_tests/mod.rs`). +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits +(except for benign "fs" hit in `skrifa-0.19.0/src/color/traversal_tests/mod.rs`). For overall `safe-to-deploy` and `does-not-implement-crypto` I am mostly relying on certification by the Chromium engineers who work on the library