Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't prompt to renew expiring wildcard audits for inactive crates #648

Merged
merged 3 commits into from
Jan 10, 2025

Conversation

mystor
Copy link
Collaborator

@mystor mystor commented Jan 9, 2025

This silences the wildcard audit renewal warning for crates which have not been updated in at least 4 months, and haven't been updated since the wildcard audit has expired.

Fixes #647

This changes some test outputs, as dates are now written as dates relative to
January 1, 2023 (which is "today" for the purposes of tests). Using dates
defined relative to "today" makes how it will interact with other checks in
cargo-vet more clear.
@mystor mystor requested a review from afranchuk January 9, 2025 19:25
Copy link
Collaborator

@afranchuk afranchuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great!

One minor nitpick is that I think the tests could use the WILDCARD_AUDIT_INACTIVE_CRATE_DURATION so that the tests are done relative to that value (if it changes, the tests won't start failing). Likewise some of the tests have comments which explicitly mention "16 weeks", but to avoid them getting out of sync it could just say "the expiry duration" or something like that.

This silences the wildcard audit renewal warning for crates which have not been
updated in at least 4 months, and haven't been updated since the wildcard audit
has expired.

Fixes mozilla#647
@mystor mystor force-pushed the wildcard_warn_less branch from ce53e93 to 0686d83 Compare January 10, 2025 19:05
@mystor
Copy link
Collaborator Author

mystor commented Jan 10, 2025

I'll mention that time in comments, but I think I prefer having the test independently verify the time spans rather than deriving the spans directly from the value used in main.rs.

@mystor mystor merged commit 57804d0 into mozilla:main Jan 10, 2025
13 checks passed
@mystor mystor deleted the wildcard_warn_less branch January 10, 2025 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Don't warn about expired/expiring wildcard audits if the crate hasn't been updated in a while
2 participants