Is your feature request related to a problem? Please describe.
rustsec/audit-check has a nice feature where it will post an issue when there are findings (and only open one issue per finding). It is a good way to discuss what to do about them, or leave a justification for one that needs to be temporarily left open.
This is nice in particular if you are running a daily security scan that doesn't block PRs or anything.
Describe the solution you'd like
I had opened a PR to audit-check to add inverted cargo tree output to the issue: rustsec/audit-check#52
There, I learned they are trying to sunset the whole action. In that case, cargo-deny's seems the most actively maintained and feature rich, and this is the only functional gap.
Presumably we would want this to be opt-in, maybe also work on finding types besides CVEs, etc. Happy to share a draft API.
Would you be open to taking a contribution on this?
Describe alternatives you've considered
I can fork cargo-audit or cargo-deny to add it easily enough, but I'd rather not fragment more.
Additional context
I maintain ci-battery-pack which currently unconditionally shows cargo-deny usage, but I'm considering cutting to audit-check to demonstrate the issue creation (though maybe not if it is being sunset...)
Is your feature request related to a problem? Please describe.
rustsec/audit-check has a nice feature where it will post an issue when there are findings (and only open one issue per finding). It is a good way to discuss what to do about them, or leave a justification for one that needs to be temporarily left open.
This is nice in particular if you are running a daily security scan that doesn't block PRs or anything.
Describe the solution you'd like
I had opened a PR to audit-check to add inverted cargo tree output to the issue: rustsec/audit-check#52
There, I learned they are trying to sunset the whole action. In that case, cargo-deny's seems the most actively maintained and feature rich, and this is the only functional gap.
Presumably we would want this to be opt-in, maybe also work on finding types besides CVEs, etc. Happy to share a draft API.
Would you be open to taking a contribution on this?
Describe alternatives you've considered
I can fork cargo-audit or cargo-deny to add it easily enough, but I'd rather not fragment more.
Additional context
I maintain ci-battery-pack which currently unconditionally shows cargo-deny usage, but I'm considering cutting to audit-check to demonstrate the issue creation (though maybe not if it is being sunset...)