8

Author: EffortlessSteven

.kiro/specs/supply-chain-fixes/tasks.md

@@ -213,15 +213,24 @@
     - Set clap default-features = false with features = ["derive"]
     - _Requirements: SC-05.4_
 
-- [ ] 8. Implement security policy enforcement
-  - [ ] 8.1 Configure comprehensive registry and VCS source restrictions
+- [x] 8. Implement security policy enforcement
+
+
+
+
+
+  - [x] 8.1 Configure comprehensive registry and VCS source restrictions
+
+
     - Update deny.toml [sources] with unknown-registry = "deny" and unknown-git = "deny"
     - Set allow-registry = ["https://github.com/rust-lang/crates.io-index"]
     - Add empty allow-git template with per-crate exception structure
     - Create CI gate to fail on git dependencies or unknown registries
     - _Requirements: NFR-C_
 
-  - [ ] 8.2 Add MSRV and edition enforcement across workspace
+  - [x] 8.2 Add MSRV and edition enforcement across workspace
+
+
     - Create CI job to validate edition = "2024" in all workspace package Cargo.toml files
     - Verify rust-version = "1.89.0" consistency across all crates
     - Add automated check that fails CI if any crate deviates from workspace standards

THIRD_PARTY_LICENSES.md

@@ -8,7 +8,7 @@ Generated on:
 
 ### MIT License
 
-**Dependencies using this license (271 total):**
+**Dependencies using this license (259 total):**
 
 
 **License Text:**

examples/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name = "flight-hub-examples"
 version = "0.1.0"
-edition = "2024"
-license = "MIT OR Apache-2.0"
-authors = ["Flight Hub Team"]
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
 publish = false
 
 # SPDX License Identifier

scripts/ci_supply_chain_gate.rs

@@ -79,6 +79,14 @@ fn main() {
     println!("\n📋 Gate 9: Cargo About Integration");
     gates.push(run_cargo_about_gate());
 
+    // Gate 10: Source Validation - Registry and VCS source restrictions
+    println!("\n🔐 Gate 10: Source Validation");
+    gates.push(run_source_validation_gate());
+    
+    // Gate 11: MSRV and Edition Enforcement - Workspace consistency
+    println!("\n📋 Gate 11: MSRV and Edition Enforcement");
+    gates.push(run_msrv_edition_gate());
+    
     // Summary
     println!("\n📊 CI Supply Chain Security Gate Summary");
     println!("=======================================");
@@ -1077,6 +1085,209 @@ fn run_cargo_about_gate() -> GateResult {
     }
 }
 
+fn run_source_validation_gate() -> GateResult {
+    println!("  Validating registry and VCS source restrictions...");
+    
+    // Run cargo deny check sources to validate source restrictions
+    let output = Command::new("cargo")
+        .args(&["deny", "--locked", "--version", "0.14.23", "check", "sources", "--format", "json"])
+        .output();
+        
+    match output {
+        Ok(result) => {
+            let exit_code = result.status.code().unwrap_or(-1);
+            let stdout = String::from_utf8_lossy(&result.stdout);
+            let stderr = String::from_utf8_lossy(&result.stderr);
+            
+            // Save raw output as artifact
+            let artifacts = save_gate_artifacts("cargo-deny-sources", &stdout, &stderr, exit_code);
+            
+            // Always check exit code first
+            if exit_code != 0 {
+                // Parse JSON for detailed error information
+                let error_details = if let Ok(report) = parse_deny_json(&stdout) {
+                    let error_count = report.diagnostics.iter()
+                        .filter(|d| d.severity == "error")
+                        .count();
+                    let warning_count = report.diagnostics.iter()
+                        .filter(|d| d.severity == "warn")
+                        .count();
+                    
+                    // Check for specific source violations
+                    let git_violations = report.diagnostics.iter()
+                        .filter(|d| d.message.contains("git") || d.message.contains("unknown-git"))
+                        .count();
+                    let registry_violations = report.diagnostics.iter()
+                        .filter(|d| d.message.contains("registry") || d.message.contains("unknown-registry"))
+                        .count();
+                    
+                    format!("{} errors, {} warnings (git: {}, registry: {})", 
+                           error_count, warning_count, git_violations, registry_violations)
+                } else {
+                    // Fallback to stderr parsing
+                    let error_lines: Vec<&str> = stderr.lines()
+                        .filter(|line| line.contains("error:") || line.contains("denied:"))
+                        .collect();
+                    format!("{} source violations detected", error_lines.len())
+                };
+                
+                return GateResult {
+                    name: "Source Validation".to_string(),
+                    passed: false,
+                    message: format!("Source restrictions violated: {}", error_details),
+                    artifacts,
+                };
+            }
+            
+            // Additional validation: Check for git dependencies using cargo tree
+            println!("    Performing additional git dependency validation...");
+            let tree_output = Command::new("cargo")
+                .args(&["tree", "--format", "{p} {r}"])
+                .output();
+                
+            match tree_output {
+                Ok(tree_result) if tree_result.status.success() => {
+                    let tree_stdout = String::from_utf8_lossy(&tree_result.stdout);
+                    let git_deps: Vec<&str> = tree_stdout.lines()
+                        .filter(|line| line.contains("git+"))
+                        .collect();
+                    
+                    if !git_deps.is_empty() {
+                        return GateResult {
+                            name: "Source Validation".to_string(),
+                            passed: false,
+                            message: format!("Found {} git dependencies: {}", 
+                                           git_deps.len(), 
+                                           git_deps.iter().take(3).map(|s| s.split_whitespace().next().unwrap_or("")).collect::<Vec<_>>().join(", ")),
+                            artifacts,
+                        };
+                    }
+                }
+                _ => {
+                    // Tree command failed, but deny passed, so continue
+                    println!("    Warning: Could not validate git dependencies with cargo tree");
+                }
+            }
+            
+            // Parse JSON output for warnings
+            if let Ok(report) = parse_deny_json(&stdout) {
+                let warnings: Vec<&Diagnostic> = report.diagnostics.iter()
+                    .filter(|d| d.severity == "warn")
+                    .collect();
+                
+                let message = if warnings.is_empty() {
+                    "All source restrictions validated - only crates.io registry allowed".to_string()
+                } else {
+                    format!("Source validation passed with {} warnings", warnings.len())
+                };
+                
+                GateResult {
+                    name: "Source Validation".to_string(),
+                    passed: true,
+                    message,
+                    artifacts,
+                }
+            } else {
+                GateResult {
+                    name: "Source Validation".to_string(),
+                    passed: true,
+                    message: "Source restrictions validated (JSON parse failed)".to_string(),
+                    artifacts,
+                }
+            }
+        }
+        Err(e) => {
+            GateResult {
+                name: "Source Validation".to_string(),
+                passed: false,
+                message: format!("Failed to run cargo deny sources: {}", e),
+                artifacts: Vec::new(),
+            }
+        }
+    }
+}
+
+fn run_msrv_edition_gate() -> GateResult {
+    println!("  Validating MSRV and edition consistency across workspace...");
+    
+    // Run the MSRV/edition validation script
+    let output = Command::new("cargo")
+        .args(&["+nightly", "-Zscript", "scripts/validate_msrv_edition.rs"])
+        .output();
+        
+    match output {
+        Ok(result) => {
+            let exit_code = result.status.code().unwrap_or(-1);
+            let stdout = String::from_utf8_lossy(&result.stdout);
+            let stderr = String::from_utf8_lossy(&result.stderr);
+            
+            // Save output as artifact
+            let artifacts = save_gate_artifacts("msrv-edition-validation", &stdout, &stderr, exit_code);
+            
+            if exit_code == 0 {
+                // Parse success message for details
+                let message = if stdout.contains("All") && stdout.contains("workspace crates comply") {
+                    // Extract the number of crates from the output
+                    if let Some(line) = stdout.lines().find(|l| l.contains("workspace crates comply")) {
+                        line.trim_start_matches("✅ ").to_string()
+                    } else {
+                        "All workspace crates comply with MSRV and edition requirements".to_string()
+                    }
+                } else {
+                    "MSRV and edition validation passed".to_string()
+                };
+                
+                GateResult {
+                    name: "MSRV and Edition Enforcement".to_string(),
+                    passed: true,
+                    message,
+                    artifacts,
+                }
+            } else {
+                // Parse failure details from output
+                let mut violations = Vec::new();
+                let mut in_violations = false;
+                
+                for line in stdout.lines() {
+                    if line.starts_with("❌") {
+                        in_violations = true;
+                        continue;
+                    }
+                    if in_violations && line.starts_with("  - ") {
+                        violations.push(line.trim_start_matches("  - ").to_string());
+                    }
+                    if in_violations && line.starts_with("💡") {
+                        break;
+                    }
+                }
+                
+                let violation_summary = if violations.is_empty() {
+                    "MSRV/edition violations detected".to_string()
+                } else {
+                    format!("{} violations: {}", 
+                           violations.len(),
+                           violations.iter().take(3).cloned().collect::<Vec<_>>().join("; "))
+                };
+                
+                GateResult {
+                    name: "MSRV and Edition Enforcement".to_string(),
+                    passed: false,
+                    message: violation_summary,
+                    artifacts,
+                }
+            }
+        }
+        Err(e) => {
+            GateResult {
+                name: "MSRV and Edition Enforcement".to_string(),
+                passed: false,
+                message: format!("Failed to run MSRV/edition validation: {}", e),
+                artifacts: Vec::new(),
+            }
+        }
+    }
+}
+
 fn save_comprehensive_artifacts(gate_name: &str, stdout: &str, stderr: &str, exit_code: i32) -> Vec<String> {
     use std::time::{SystemTime, UNIX_EPOCH};