aleleba/pdfcraft
1
0
Fork 0
mirror of https://github.com/storytold/pdfcraft.git synced 2026-10-24 01:57:12 -06:00
Code Issues Packages Projects Releases Wiki Activity

chore(sonar): exclude vendored crates and the spec-mandated MD5/RIPEMD-160 (SonarCloud rust:S4790)

Browse Source 
vendor/ is third-party code kept close to upstream (vendor/README.md), so SonarCloud's
186 findings there are not ours to restyle. MD5 in crates/crypt is what ISO 32000's
standard security handler mandates, and RIPEMD-160 in crates/sign is a digest existing
signatures can name; both S4790 findings are scoped to those two files.
This commit is contained in:
Dylan M. Taylor
2026-10-22 22:36:03 -04:00
parent de91632934
commit bd9030b271
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sonar-project.properties
+14
View File
@@ -1,2 +1,16 @@
sonar.projectKey=storytold_pdfcraft
sonar.organization=storytold
# vendor/ holds third-party crates carried with small, marked patches (vendor/README.md).
# They are kept close to upstream so each copy can be dropped once upstream releases the
# fix; restyling them would only make that harder, so they are not analysed here.
sonar.exclusions=vendor/**
# S4790 (weak hash): MD5 is the hash ISO 32000 mandates for the RC4/AES-128 standard security
# handler (Algorithms 1-5), and RIPEMD-160 is a digest existing signatures may name. Both are
# needed to open and verify existing files, not chosen for new security.
sonar.issue.ignore.multicriteria=crypt_md5,sign_ripemd
sonar.issue.ignore.multicriteria.crypt_md5.ruleKey=rust:S4790
sonar.issue.ignore.multicriteria.crypt_md5.resourceKey=crates/crypt/src/lib.rs
sonar.issue.ignore.multicriteria.sign_ripemd.ruleKey=rust:S4790
sonar.issue.ignore.multicriteria.sign_ripemd.resourceKey=crates/sign/src/keys.rs