# cargo-audit configuration (read by `cargo audit`, the release `audit` gate).
#
# The gate stays strict: every advisory fails the build EXCEPT the explicitly
# listed ones below, each with a written rationale. Revisit on every dep bump.

[advisories]
ignore = [
    # RUSTSEC-2023-0071 — "Marvin Attack" RSA timing side-channel in the `rsa`
    # crate (no fixed version exists upstream). It reaches us only through
    # `jsonwebtoken`'s `rust_crypto` backend, where we use RSA strictly for
    # signature VERIFICATION of inbound OIDC JWTs (a public-key operation). The
    # attack recovers a private key via a decryption/signing timing oracle; the
    # shipped binary performs no RSA private-key operations, so it does not apply.
    # (The only private-key use is the dev-dependency `rsa`, which mints test
    # tokens — test-only, never shipped, not attacker-exposed.) The real fix —
    # jsonwebtoken's `aws_lc_rs` backend — pulls a C/cmake build dependency that
    # breaks the static-musl release legs, which is why Cargo.toml deliberately
    # pins `rust_crypto`. Re-evaluate if a fixed `rsa` ships or we move off RSA.
    "RUSTSEC-2023-0071",
]
