inspequte-cargo-audit-fix

分类: 测试与安全 | 上传者: KengoTODA | 下载: 0 | 版本: v1.0（最新）

通过读取货物审计 SARIF 输出、以最小的依赖项更改更新 Cargo.toml 或 Cargo.lock，以及使用货物构建、货物测试和货物审计进行验证，修复 inspequte 中的 Rust 依赖项审计失败。

更新日志: Source: GitHub https://github.com/KengoTODA/inspequte

目录结构

当前层级: tree/main/.codex/skills/inspequte-cargo-audit-fix/

📁 agents/
- 📄 openai.yaml 252 B
📄 SKILL.md 2.5 KB

SKILL.md

---
name: inspequte-cargo-audit-fix
description: Fix Rust dependency audit failures in inspequte by reading cargo audit SARIF output, updating Cargo.toml or Cargo.lock with minimal dependency changes, and verifying with cargo build, cargo test, and cargo audit.
---

# inspequte cargo audit fix

## Inputs
- `cargo audit --format sarif` output, usually `target/audit-input/audit.sarif` or `target/audit.sarif`.
- `Cargo.toml` and `Cargo.lock`.
- The minimum surrounding files needed to understand dependency use.

## Outputs
- Minimal dependency updates in `Cargo.lock`.
- `Cargo.toml` updates only when a direct dependency constraint prevents resolving a fixed version.
- A clear final report listing fixed advisories and any unresolved manual follow-ups.

## Workflow
1. Read the SARIF report and identify each affected crate, current version, advisory ID, severity, and fixed version or patched range.
2. Prefer lockfile-only updates:
   - Run `cargo update -p <crate> --precise <fixed_version>` when SARIF or RustSec data gives one concrete fixed version.
   - If only a version range is available, choose the lowest compatible patched version.
3. Edit `Cargo.toml` only when the fixed version cannot be selected under the existing direct dependency requirement.
4. Keep changes narrowly scoped to the vulnerable dependency and resolver-required transitive updates.
5. Do not add compatibility shims, alternate dependency paths, or unrelated crate upgrades.
6. Run `cargo fmt` after code or manifest changes.
7. Verify with:
   - `cargo build`
   - `cargo test`
   - `cargo audit --format sarif`
8. If verification fails, continue only when the next step is clear from the error. Otherwise stop and report:
   - unresolved crate or advisory
   - attempted update
   - blocking error
   - required human decision

## Guardrails
- Treat the SARIF report as the source of truth for the audit failure being fixed.
- Prefer simplicity over backward compatibility.
- Do not update unrelated dependencies for freshness.
- Do not ignore advisories or add audit suppressions.
- Preserve Conventional Commit style when committing: `fix(deps): resolve cargo audit findings`.
- Use ASCII-only edits unless a touched file already requires Unicode.

## Definition of Done
- `cargo audit --format sarif` exits successfully.
- `cargo build` and `cargo test` pass.
- The diff is limited to dependency files unless source changes are necessary for the dependency update.
- Any unresolved advisory is documented with concrete evidence.

登录后下载/点赞/收藏 ❤ 6 | ★ 0

inspequte-cargo-audit-fix

目录结构

SKILL.md

举报内容

提示