From bd9030b27178d9cf9d39226680637d3786a5cac5 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Thu, 22 Oct 2026 22:36:03 -0400 Subject: [PATCH] chore(sonar): exclude vendored crates and the spec-mandated MD5/RIPEMD-160 (SonarCloud rust:S4790) vendor/ is third-party code kept close to upstream (vendor/README.md), so SonarCloud's 186 findings there are not ours to restyle. MD5 in crates/crypt is what ISO 32000's standard security handler mandates, and RIPEMD-160 in crates/sign is a digest existing signatures can name; both S4790 findings are scoped to those two files. --- sonar-project.properties | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sonar-project.properties b/sonar-project.properties index 30e80a0c5..7d0926a24 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -1,2 +1,16 @@ sonar.projectKey=storytold_pdfcraft sonar.organization=storytold + +# vendor/ holds third-party crates carried with small, marked patches (vendor/README.md). +# They are kept close to upstream so each copy can be dropped once upstream releases the +# fix; restyling them would only make that harder, so they are not analysed here. +sonar.exclusions=vendor/** + +# S4790 (weak hash): MD5 is the hash ISO 32000 mandates for the RC4/AES-128 standard security +# handler (Algorithms 1-5), and RIPEMD-160 is a digest existing signatures may name. Both are +# needed to open and verify existing files, not chosen for new security. +sonar.issue.ignore.multicriteria=crypt_md5,sign_ripemd +sonar.issue.ignore.multicriteria.crypt_md5.ruleKey=rust:S4790 +sonar.issue.ignore.multicriteria.crypt_md5.resourceKey=crates/crypt/src/lib.rs +sonar.issue.ignore.multicriteria.sign_ripemd.ruleKey=rust:S4790 +sonar.issue.ignore.multicriteria.sign_ripemd.resourceKey=crates/sign/src/keys.rs