[mangoleaf]

What

Adds docs/SUPPLY_CHAIN.md, the risk record for the dependencies on the network and TLS path: one row for each of 34 direct dependencies (axum, tower, tower-http, http-body, httpdate, tokio, socket2, tokio-tungstenite, futures-core, futures-util, reqwest, rustls, tokio-rustls, rustls-native-certs, x509-parser, rcgen, p12-keystore, ldap3, if-addrs, url, percent-encoding, form_urlencoded, serde_urlencoded, opentelemetry, opentelemetry_sdk, opentelemetry-prometheus, opentelemetry-otlp, tracing-opentelemetry, prometheus, secrecy, pbkdf2, sha1, sha2, base64). Each row records the locked version, unsafe code (count and where), native or C code, build script, proc macros, the untrusted input that reaches the crate in Ferrofin, maintenance state, RustSec history, cargo crev crate verify, and the cargo-vet audit that covers the locked version. A legend defines every column and an Evidence section says how each fact was read.

No audits are written. supply-chain/ is unchanged. Four crates are covered by imported audits (futures-core, httpdate, percent-encoding, form_urlencoded); the other 30 stay under [[exemptions]], and each such row says "Exempted, not audited".

Upgrade note: none.

Why

Nobody had recorded what each network and TLS crate is trusted with, or which audit stands behind its version. This is the first of three risk-record phases of the dependency-audit work (gl-1367); the other two cover parsers of untrusted media and files, and native code, build-time, WASM-runtime and remaining crates, and will add their own sections to the same file.

The audit half of the phase is not done, on purpose. Ferrofin is not writing audits of its own, so the exemptions that cannot be retired by an import stay. The 30 that stay, and why: axum, tower, tower-http, http-body, tokio, socket2, tokio-tungstenite, futures-util, reqwest, rustls, tokio-rustls, rustls-native-certs, x509-parser, rcgen, p12-keystore, ldap3, if-addrs, url, serde_urlencoded, opentelemetry, opentelemetry_sdk, opentelemetry-prometheus, opentelemetry-otlp, tracing-opentelemetry, prometheus, secrecy, pbkdf2, sha1, sha2 and base64 have no imported audit at their locked version. None of the six organisations Ferrofin imports audits them (only base64 0.22.1 and sha2 0.10.9 have an audit of an older version), and the three other organisations in the cargo-vet public registry (Actix, Ariel OS, Fermyon) audit none of them either. An exemption leaves when an import starts to cover its version (cargo vet, then cargo vet prune).

How

Everything is in the one new file. How the facts were read, so a reviewer can re-run it:

• Published source against upstream. The commit in each crate's .cargo_vcs_info.json was fetched and diffed against the published source: nothing differs (apart from cargo's own .cargo-ok). http-body, percent-encoding and form_urlencoded were published from a dirty tree; only their manifests differ (a version and a category spelling).
• Native code and proc macros come from cargo tree -p ferrofin-server -e normal,build --target x86_64-unknown-linux-gnu --no-dedupe, the shipped build, not from cargo metadata. cargo metadata unifies dev-dependency features and wrongly showed AWS-LC below x509-parser; the two dev-only crates (rcgen, tokio-tungstenite 0.30.0) are marked as test-build facts.
• RustSec is read from the advisory database cargo-deny uses; every locked version carries the fixes for the advisories filed against it, including the October 2026 rustls (0.23.46) and tokio (1.54.1) releases.
• cargo-crev reports N/A on every row: with no trusted reviewer configured it prints "There are no trusted Ids" and shows no review counts. Ferrofin publishes no crev proofs and gates nothing on crev.
• Unsafe code is counted on non-comment lines. prometheus's five sites are behind features Ferrofin leaves off.

Worth a close look: the legend (the column definitions the other two phases will reuse), the base64 row (0.23's default simd-unsafe feature compiles the opt-in SIMD engines in, but nothing in the shipped tree selects one), and the tokio-tungstenite row (Ferrofin's 0.30.0 is test-only; the WebSocket stack that ships is axum's 0.29.0).

No real problem was found, so no issue is linked from a row.

Verification

• Docs-only change: one new Markdown file, nothing under crates/, apps/, scripts/, .github/ or Cargo.*, so the cargo gates are skipped (docs-only exception). No handler or core path is touched, so there is no parity row to write.
• cargo vet --locked (cargo-vet 0.10.3, the CI version): Vetting Succeeded (137 fully audited, 2 partially audited, 406 exempted), the same as on the base.
• The table has 34 crate rows of 11 cells each; the file contains no GitLab issue numbers, e-mail addresses or local paths.
• The file was reviewed in three independent rounds against the published sources, Cargo.lock, the advisory database, supply-chain/ and Ferrofin's own call sites. Each round's factual corrections are in the file (the base64 description, AWS-LC below x509-parser, the proc-macro closures, consumer lists and counts).
• Merge danger
  • Stacked on: nothing.
  • Conflicts left for merge time: none with an open PR. The two other risk-record phases also create docs/SUPPLY_CHAIN.md; whichever merges second keeps both sections.
  • Door: two-way, a revert removes the file.
  • Blast radius: none at run time; documentation only.

Checklist

• Commit subjects follow Conventional Commits (type(scope): subject) and are signed off (git commit -s)