Add dependency license and advisory checks

Author: tillrohrmann

.github/workflows/deps.yml

@@ -0,0 +1,33 @@
+name: Check dependencies
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - justfile
+      - Cargo.lock
+      - Cargo.toml
+      - deny.toml
+      - .github/workflows/deps.yml
+
+jobs:
+  advisories:
+    timeout-minutes: 10
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories
+
+  policy:
+    timeout-minutes: 10
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check bans licenses sources

Cargo.toml

@@ -36,4 +36,4 @@ assert2 = "0.4.0"
 prost-build = "0.14"
 rstest = "0.26.1"
 ed25519-dalek = { version = "2", features = ["pkcs8", "rand_core"] }
-rand = "0.8"
+rand_core = { version = "0.6", features = ["getrandom"] }

deny.toml

@@ -0,0 +1,37 @@
+[advisories]
+db-path = "~/.cargo/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+# https://github.com/EmbarkStudios/cargo-deny/pull/611
+version = 2
+yanked = "deny"
+ignore = [
+    { id = "RUSTSEC-2026-0097", reason = "jsonwebtoken's rust_crypto backend pulls in rand 0.8 for key generation, but this crate only uses Ed25519 verification in production and uses OsRng-based key generation in tests" },
+    { id = "RUSTSEC-2023-0071", reason = "jsonwebtoken's rust_crypto feature enables RSA support transitively, but this crate verifies EdDSA identity tokens and does not use RSA keys or RSA signature verification" },
+]
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-3-Clause",
+    "Unicode-3.0",
+]
+confidence-threshold = 0.8
+
+[licenses.private]
+ignore = true
+registries = []
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+allow = []
+skip = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

justfile

@@ -55,7 +55,7 @@ clippy: (_target-installed target)
     cargo clippy {{ _target-option }} {{ _features }} --all-targets --workspace -- -D warnings
 
 # Runs all lints (fmt, clippy, deny)
-lint: check-fmt clippy
+lint: check-fmt clippy check-deny
 
 build *flags: (_target-installed target)
     cargo build {{ _target-option }} {{ _features }} {{ flags }}
@@ -72,6 +72,9 @@ verify: lint test
 udeps *flags:
     RUSTC_BOOTSTRAP=1 cargo udeps --all-features --all-targets {{ flags }}
 
+check-deny:
+    cargo deny --all-features check
+
 _target-installed target:
     #!/usr/bin/env bash
     set -euo pipefail

src/request_identity.rs

@@ -164,7 +164,7 @@ mod tests {
 
     use ed25519_dalek::pkcs8::EncodePrivateKey;
     use ed25519_dalek::SigningKey;
-    use rand::rngs::OsRng;
+    use rand_core::OsRng;
     use serde::Serialize;
     use std::time::SystemTime;