chore: move specific CI audit rules into global .cargo/audit.toml

.cargo/audit.toml

@@ -0,0 +1,15 @@
+[advisories]
+ignore = [
+    # paste unmaintained — transitive via azure_core 0.21.0 (latest available).
+    # No direct security impact; no upgrade path exists.
+    # keep warning "RUSTSEC-2024-0436",
+
+    # rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
+    # Only exploitable with a custom logger using rand::rng(); not applicable here.
+    "RUSTSEC-2026-0097",
+
+    # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
+    # Not affected: This application uses HS256 for internal JWT signing and only performs
+    # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
+    "RUSTSEC-2023-0071",
+]

.github/workflows/ci.yml

@@ -136,13 +136,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
-      # Not affected: This application uses HS256 for internal JWT signing and only performs
-      # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          ignore: RUSTSEC-2023-0071
 
   build:
     name: Build Check

.gitignore

@@ -20,9 +20,10 @@
 *.su
 *.idb
 
-# Build cache (keep .cargo/config.toml for project build settings)
+# Build cache (keep .cargo/config.toml for project build settings, keep audit config)
 .cargo/*
 !.cargo/config.toml
+!.cargo/audit.toml
 
 # temporary file to tools
 tmp/

justfile

@@ -39,7 +39,7 @@ check:
 
 # audit security (condition: cargo install cargo-audit)
 audit:
-    cargo audit --ignore RUSTSEC-2023-0071
+    cargo audit
 
 openapi:
     cargo run --bin generate-openapi