cargo-geiger.json

{
  "version": 1,
  "comment": "HARDEN-03 D-22 — crates permitted to use unsafe in the dep tree. Each entry is justified. Supersedes D-12 (cargo-deny has no unsafe knob). See .planning/phases/10-hardening-release/10-CONTEXT.md and 10-RESEARCH.md Pattern 5 / Pitfall B.",
  "allowlist": [
    {"name": "objc2",                 "reason": "AppKit FFI is unsafe by definition (Pitfall 14 — Cocoa interop)"},
    {"name": "objc2-app-kit",         "reason": "AppKit FFI"},
    {"name": "objc2-foundation",      "reason": "AppKit FFI"},
    {"name": "objc2-core-foundation", "reason": "AppKit FFI"},
    {"name": "objc2-core-graphics",   "reason": "AppKit FFI (CGFontRef in crossfont)"},
    {"name": "objc2-quartz-core",     "reason": "Metal layer FFI"},
    {"name": "objc2-metal",           "reason": "Metal FFI used by wgpu-hal"},
    {"name": "objc2-encode",          "reason": "objc2 ObjC type encoding"},
    {"name": "objc2-core-text",       "reason": "CoreText FFI"},
    {"name": "objc2-io-surface",      "reason": "IOSurface FFI (wgpu-hal metal)"},
    {"name": "block2",                "reason": "ObjC block FFI (objc2 family)"},
    {"name": "dispatch2",             "reason": "libdispatch FFI (objc2 family)"},
    {"name": "core-foundation",       "reason": "CoreFoundation FFI"},
    {"name": "core-foundation-sys",   "reason": "CoreFoundation raw bindings"},
    {"name": "core-graphics",         "reason": "CoreGraphics FFI"},
    {"name": "core-graphics-types",   "reason": "CoreGraphics types"},
    {"name": "core-text",             "reason": "CoreText FFI"},
    {"name": "io-surface",            "reason": "IOSurface FFI"},
    {"name": "mach2",                 "reason": "macOS kernel syscalls"},
    {"name": "wgpu",                  "reason": "GPU bindings (D-22)"},
    {"name": "wgpu-core",             "reason": "wgpu internals"},
    {"name": "wgpu-hal",              "reason": "Metal HAL"},
    {"name": "wgpu-types",            "reason": "wgpu support"},
    {"name": "naga",                  "reason": "wgpu shader frontend"},
    {"name": "metal",                 "reason": "metal-rs — wgpu-hal Metal backend"},
    {"name": "ash",                   "reason": "Vulkan bindings pulled by wgpu (unused on macOS but transitive)"},
    {"name": "alacritty_terminal",    "reason": "VT parser (D-22)"},
    {"name": "vte",                   "reason": "VT parser inner; transitive dep of alacritty_terminal"},
    {"name": "vte_generate_state_changes", "reason": "vte support"},
    {"name": "crossfont",             "reason": "CoreText FFI (D-22)"},
    {"name": "freetype-rs",           "reason": "transitive font shaping FFI"},
    {"name": "freetype-sys",          "reason": "freetype raw bindings"},
    {"name": "servo-fontconfig",      "reason": "transitive font lookup FFI (macOS fallback path)"},
    {"name": "servo-fontconfig-sys",  "reason": "fontconfig raw bindings"},
    {"name": "yeslogic-fontconfig-sys", "reason": "fontconfig raw bindings (alt name)"},
    {"name": "portable-pty",          "reason": "PTY syscalls (D-22)"},
    {"name": "russh",                 "reason": "SSH transport crypto primitives"},
    {"name": "russh-keys",            "reason": "russh key formats"},
    {"name": "russh-cryptovec",       "reason": "russh zeroize backing"},
    {"name": "bytemuck",              "reason": "type-punning for wgpu buffers — ecosystem foundation"},
    {"name": "tokio",                 "reason": "async runtime — ecosystem foundation"},
    {"name": "tokio-util",            "reason": "tokio support"},
    {"name": "mio",                   "reason": "tokio's IO primitive — ecosystem foundation"},
    {"name": "parking_lot",           "reason": "mutex primitives — ecosystem foundation"},
    {"name": "parking_lot_core",      "reason": "parking_lot internals"},
    {"name": "lock_api",              "reason": "parking_lot support"},
    {"name": "memchr",                "reason": "SIMD byte search — ecosystem foundation"},
    {"name": "smallvec",              "reason": "small-vector optimization — ecosystem foundation"},
    {"name": "arrayvec",              "reason": "fixed-cap vec — ecosystem foundation"},
    {"name": "raw-window-handle",     "reason": "winit↔wgpu seam — ecosystem foundation"},
    {"name": "winit",                 "reason": "windowing — required platform FFI"},
    {"name": "libc",                  "reason": "libc FFI — ecosystem foundation"},
    {"name": "nix",                   "reason": "Unix syscalls — used by portable-pty + vector-pty"},
    {"name": "rustix",                "reason": "Unix syscalls — used by mio/tokio"},
    {"name": "linux-raw-sys",         "reason": "rustix backing on Linux (transitive)"},
    {"name": "errno",                 "reason": "errno extraction — ecosystem foundation"},
    {"name": "libloading",            "reason": "dlopen FFI (wgpu-hal)"},
    {"name": "ring",                  "reason": "rustls crypto primitives (transitive)"},
    {"name": "aws-lc-rs",             "reason": "rustls aws-lc backend (test-only, transitive)"},
    {"name": "aws-lc-sys",            "reason": "aws-lc raw bindings"},
    {"name": "rustls",                "reason": "TLS implementation — ecosystem foundation"},
    {"name": "untrusted",             "reason": "ring support"},
    {"name": "zeroize",               "reason": "secure memory wipe — used by vector-secrets"},
    {"name": "zerocopy",              "reason": "safe transmute alternative (uses unsafe internally)"},
    {"name": "crc32fast",             "reason": "SIMD CRC — ecosystem foundation"},
    {"name": "adler",                 "reason": "adler checksum — ecosystem foundation"},
    {"name": "adler2",                "reason": "adler v2 — ecosystem foundation"},
    {"name": "miniz_oxide",           "reason": "zlib replacement — ecosystem foundation"},
    {"name": "crossbeam-channel",     "reason": "lock-free channels"},
    {"name": "crossbeam-deque",       "reason": "work-stealing deque"},
    {"name": "crossbeam-epoch",       "reason": "epoch-based reclamation"},
    {"name": "crossbeam-utils",       "reason": "crossbeam primitives"},
    {"name": "scopeguard",            "reason": "scope guards — ecosystem foundation"},
    {"name": "once_cell",             "reason": "lazy statics — ecosystem foundation"},
    {"name": "lazy_static",           "reason": "lazy statics (legacy) — ecosystem foundation"},
    {"name": "spin",                  "reason": "spinlock — used by lazy_static / ring"},
    {"name": "ahash",                 "reason": "fast hasher — ecosystem foundation"},
    {"name": "hashbrown",             "reason": "swiss-table — ecosystem foundation"},
    {"name": "indexmap",              "reason": "ordered map — ecosystem foundation"},
    {"name": "slab",                  "reason": "slab allocator — ecosystem foundation"},
    {"name": "smol_str",              "reason": "interned strings — ecosystem foundation"},
    {"name": "compact_str",           "reason": "small-string optimization"},
    {"name": "bytes",                 "reason": "bytes buffer — ecosystem foundation"},
    {"name": "ryu",                   "reason": "f64 → string — ecosystem foundation"},
    {"name": "itoa",                  "reason": "int → string — ecosystem foundation"},
    {"name": "lexical-core",          "reason": "string ↔ numeric parsing"},
    {"name": "num-traits",            "reason": "numeric trait — ecosystem foundation"},
    {"name": "rand",                  "reason": "randomness — ecosystem foundation"},
    {"name": "rand_core",             "reason": "rand support"},
    {"name": "rand_chacha",           "reason": "ChaCha RNG (used by oauth2/ring)"},
    {"name": "getrandom",             "reason": "OS RNG — ecosystem foundation"},
    {"name": "getrandom_or_panic",    "reason": "getrandom variant"},
    {"name": "rayon",                 "reason": "parallel iterator (insta, image-compare transitive)"},
    {"name": "rayon-core",            "reason": "rayon internals"},
    {"name": "futures-util",          "reason": "futures combinators — ecosystem foundation"},
    {"name": "futures-task",          "reason": "futures support"},
    {"name": "futures-channel",       "reason": "futures channels"},
    {"name": "futures-executor",      "reason": "futures executor"},
    {"name": "futures-io",            "reason": "futures IO"},
    {"name": "futures-sink",          "reason": "futures sink"},
    {"name": "futures-core",          "reason": "futures core"},
    {"name": "atomic-waker",          "reason": "atomic waker — futures support"},
    {"name": "pin-project-lite",      "reason": "pin projection — async ecosystem"},
    {"name": "pin-utils",             "reason": "pin utilities"},
    {"name": "sharded-slab",          "reason": "tracing-subscriber backing"},
    {"name": "tracing-core",          "reason": "tracing crate primitive"},
    {"name": "tracing-log",           "reason": "tracing↔log bridge"},
    {"name": "tracing-subscriber",    "reason": "tracing subscriber — used in tests"},
    {"name": "thread_local",          "reason": "thread-local — ecosystem foundation"},
    {"name": "encoding_rs",           "reason": "text encoding"},
    {"name": "icu_collections",       "reason": "ICU collections (locale)"},
    {"name": "icu_locale_core",       "reason": "ICU locale core"},
    {"name": "icu_normalizer",        "reason": "ICU normalizer"},
    {"name": "icu_normalizer_data",   "reason": "ICU normalizer data"},
    {"name": "icu_properties",        "reason": "ICU properties"},
    {"name": "icu_properties_data",   "reason": "ICU properties data"},
    {"name": "icu_provider",          "reason": "ICU provider"},
    {"name": "url",                   "reason": "URL parser — ecosystem foundation"},
    {"name": "form_urlencoded",       "reason": "URL form encoding"},
    {"name": "percent-encoding",      "reason": "URL percent encoding"},
    {"name": "idna",                  "reason": "IDNA URL handling"},
    {"name": "idna_adapter",          "reason": "IDNA adapter"},
    {"name": "tinystr",               "reason": "ICU short-string"},
    {"name": "yoke",                  "reason": "ICU yoke"},
    {"name": "zerofrom",              "reason": "ICU zerofrom"},
    {"name": "zerotrie",              "reason": "ICU trie"},
    {"name": "zerovec",               "reason": "ICU zerovec"},
    {"name": "writeable",             "reason": "ICU writeable"},
    {"name": "litemap",               "reason": "ICU litemap"},
    {"name": "potential_utf",         "reason": "ICU UTF backing"},
    {"name": "serde",                 "reason": "serialization — ecosystem foundation"},
    {"name": "serde_json",            "reason": "JSON — ecosystem foundation"},
    {"name": "serde_path_to_error",   "reason": "serde path tracker"},
    {"name": "regex",                 "reason": "regex — ecosystem foundation"},
    {"name": "regex-automata",        "reason": "regex internals"},
    {"name": "regex-syntax",          "reason": "regex parsing"},
    {"name": "aho-corasick",          "reason": "regex multi-pattern"},
    {"name": "tinyvec",               "reason": "small vec variant"},
    {"name": "tinyvec_macros",        "reason": "tinyvec helper"},
    {"name": "anyhow",                "reason": "error type — ecosystem foundation"},
    {"name": "thiserror",             "reason": "error derive — ecosystem foundation"},
    {"name": "thiserror-impl",        "reason": "thiserror proc-macro"},
    {"name": "syn",                   "reason": "proc-macro AST — build-script unsafe"},
    {"name": "proc-macro2",           "reason": "proc-macro primitives — build-script unsafe"},
    {"name": "quote",                 "reason": "proc-macro quoting"},
    {"name": "unicode-segmentation",  "reason": "Unicode segmentation"},
    {"name": "unicode-width",         "reason": "Unicode width — terminal-essential"},
    {"name": "unicode-ident",         "reason": "Unicode identifier classification"},
    {"name": "unicode-bidi",          "reason": "Unicode bidi"},
    {"name": "unicode-normalization", "reason": "Unicode normalization"},
    {"name": "chrono",                "reason": "datetime — ecosystem foundation"},
    {"name": "time",                  "reason": "time crate — ecosystem foundation"},
    {"name": "time-core",             "reason": "time crate primitive"},
    {"name": "iana-time-zone",        "reason": "tz lookup FFI"},
    {"name": "iana-time-zone-haiku",  "reason": "Haiku tz support (transitive)"},
    {"name": "num-conv",              "reason": "numeric conversion (time)"},
    {"name": "powerfmt",              "reason": "formatting helper"},
    {"name": "reqwest",               "reason": "HTTP client — ecosystem foundation"},
    {"name": "hyper",                 "reason": "HTTP/1+2 — reqwest backing"},
    {"name": "hyper-util",            "reason": "hyper helpers"},
    {"name": "hyper-tls",             "reason": "hyper TLS shim"},
    {"name": "hyper-rustls",          "reason": "hyper-rustls"},
    {"name": "h2",                    "reason": "HTTP/2 — reqwest backing"},
    {"name": "http",                  "reason": "HTTP types"},
    {"name": "http-body",             "reason": "HTTP body"},
    {"name": "http-body-util",        "reason": "HTTP body utilities"},
    {"name": "tower",                 "reason": "tower middleware (octocrab/hyper)"},
    {"name": "tower-service",         "reason": "tower service trait"},
    {"name": "tower-http",            "reason": "tower HTTP middleware"},
    {"name": "rustls-pki-types",      "reason": "rustls PKI types"},
    {"name": "rustls-webpki",         "reason": "rustls webpki"},
    {"name": "webpki-roots",          "reason": "rustls trust roots"},
    {"name": "sct",                   "reason": "rustls CT support"},
    {"name": "x509-cert",             "reason": "X.509 parsing"},
    {"name": "der",                   "reason": "DER encoding"},
    {"name": "pem",                   "reason": "PEM encoding"},
    {"name": "pem-rfc7468",           "reason": "PEM RFC 7468"},
    {"name": "pkcs8",                 "reason": "PKCS#8 parsing"},
    {"name": "pkcs1",                 "reason": "PKCS#1 parsing"},
    {"name": "spki",                  "reason": "SubjectPublicKeyInfo"},
    {"name": "rsa",                   "reason": "RSA crypto (tunnels/octocrab transitive)"},
    {"name": "sha1",                  "reason": "SHA-1 — crypto primitive"},
    {"name": "sha2",                  "reason": "SHA-256/384/512 — crypto primitive"},
    {"name": "md-5",                  "reason": "MD5 — crypto primitive (transitive)"},
    {"name": "digest",                "reason": "crypto digest trait"},
    {"name": "block-buffer",          "reason": "block cipher buffer"},
    {"name": "generic-array",         "reason": "fixed-size array for crypto"},
    {"name": "typenum",               "reason": "compile-time numerics for crypto"},
    {"name": "subtle",                "reason": "constant-time comparison"},
    {"name": "const-oid",             "reason": "OID constants"},
    {"name": "ed25519-dalek",         "reason": "ED25519 — russh-keys"},
    {"name": "curve25519-dalek",      "reason": "Curve25519 — russh"},
    {"name": "curve25519-dalek-derive", "reason": "curve25519-dalek proc-macro"},
    {"name": "x25519-dalek",          "reason": "X25519 KEX — russh"},
    {"name": "polynomial",            "reason": "polynomial math (transitive)"},
    {"name": "polyval",               "reason": "GCM auth tag math"},
    {"name": "universal-hash",        "reason": "universal hash trait"},
    {"name": "crypto-common",         "reason": "RustCrypto common"},
    {"name": "cipher",                "reason": "RustCrypto cipher trait"},
    {"name": "aead",                  "reason": "AEAD trait"},
    {"name": "aes",                   "reason": "AES cipher"},
    {"name": "aes-gcm",               "reason": "AES-GCM AEAD"},
    {"name": "ctr",                   "reason": "CTR mode"},
    {"name": "ghash",                 "reason": "GHASH for GCM"},
    {"name": "chacha20",              "reason": "ChaCha20 cipher"},
    {"name": "chacha20poly1305",      "reason": "ChaCha20-Poly1305 AEAD"},
    {"name": "poly1305",              "reason": "Poly1305 MAC"},
    {"name": "hmac",                  "reason": "HMAC"},
    {"name": "inout",                 "reason": "RustCrypto in/out"},
    {"name": "cpufeatures",           "reason": "CPU feature detection — crypto"},
    {"name": "futures",               "reason": "future combinators meta"},
    {"name": "async-channel",         "reason": "async channel"},
    {"name": "async-task",            "reason": "async task"},
    {"name": "tunnels",               "reason": "Microsoft dev-tunnels SDK (vendored)"},
    {"name": "boring-sys",            "reason": "BoringSSL FFI (transitive)"},
    {"name": "boring",                "reason": "BoringSSL wrapper"},
    {"name": "vector-app",            "reason": "first-party AppKit FFI (NSWindow, NSMenu via objc2)"},
    {"name": "vector-mux",            "reason": "first-party libproc::pidcwd (foreground process tracking)"},
    {"name": "bit-set", "reason": "bitset over bit-vec; inherent"},
    {"name": "bit-vec", "reason": "bit-vector storage; inherent"},
    {"name": "block-padding", "reason": "constant-time crypto padding (cipher chain); inherent"},
    {"name": "byteorder", "reason": "endian read/write; inherent"},
    {"name": "data-encoding", "reason": "base64/hex fast paths; inherent"},
    {"name": "dirs-sys", "reason": "platform config-dir FFI; unsafe inherent"},
    {"name": "dispatch", "reason": "Grand Central Dispatch FFI (macOS); platform FFI"},
    {"name": "either", "reason": "Either enum; minimal unsafe helper"},
    {"name": "euclid", "reason": "geometry math (servo); inherent"},
    {"name": "file-id", "reason": "filesystem id FFI (notify); platform FFI"},
    {"name": "filedescriptor", "reason": "raw fd wrapper (portable-pty); platform FFI"},
    {"name": "flate2", "reason": "DEFLATE (miniz/zlib) buffers; inherent"},
    {"name": "foldhash", "reason": "fast hasher (hashbrown); inherent"},
    {"name": "foreign-types-shared", "reason": "FFI newtype helper (openssl/security-framework); inherent"},
    {"name": "fsevent-sys", "reason": "macOS FSEvents FFI (notify); platform FFI"},
    {"name": "half", "reason": "f16 bit-twiddling + SIMD; inherent"},
    {"name": "httparse", "reason": "SIMD HTTP header parsing (hyper); inherent"},
    {"name": "jiff", "reason": "datetime library (tzdb); inherent"},
    {"name": "libm", "reason": "libm port using raw float bit ops; inherent"},
    {"name": "libproc", "reason": "macOS libproc FFI (process info); platform FFI"},
    {"name": "log", "reason": "logging facade; minimal unsafe"},
    {"name": "matchers", "reason": "regex automaton for tracing-subscriber EnvFilter; inherent"},
    {"name": "native-tls", "reason": "TLS for the dev-tunnels SDK websocket relay (tokio-tungstenite default); SDK-mandated per CLAUDE.md §7"},
    {"name": "notify", "reason": "filesystem watcher; platform FFI"},
    {"name": "num-bigint", "reason": "bignum limb ops; inherent"},
    {"name": "objc2-cloud-kit", "reason": "AppKit FFI sibling (objc2 family); Cocoa interop unsafe by definition"},
    {"name": "objc2-core-data", "reason": "AppKit FFI sibling (objc2 family); Cocoa interop unsafe by definition"},
    {"name": "objc2-core-image", "reason": "AppKit FFI sibling (objc2 family); Cocoa interop unsafe by definition"},
    {"name": "objc2-core-video", "reason": "AppKit FFI sibling (objc2 family); Cocoa interop unsafe by definition"},
    {"name": "openssl", "reason": "pulled by the SDK's pinned russh 0.37 (CLAUDE.md §7 russh skew); SDK-mandated"},
    {"name": "openssl-sys", "reason": "OpenSSL FFI via the SDK's russh 0.37; SDK-mandated per CLAUDE.md §7"},
    {"name": "os_info", "reason": "OS detection via platform FFI"},
    {"name": "polling", "reason": "kqueue/epoll event-loop FFI (async-io); platform FFI"},
    {"name": "ppv-lite86", "reason": "SIMD backend for rand; unsafe for vectorization"},
    {"name": "raw-window-metal", "reason": "Metal layer handle for wgpu on macOS; platform FFI"},
    {"name": "rustix-openpty", "reason": "openpty syscall wrapper (terminal); platform FFI"},
    {"name": "rustls-platform-verifier", "reason": "OS trust-store verifier FFI; platform FFI"},
    {"name": "same-file", "reason": "file-identity FFI (walkdir); platform FFI"},
    {"name": "security-framework", "reason": "macOS Keychain/TLS trust FFI (native-tls + keyring); platform FFI"},
    {"name": "serde_core", "reason": "serde internals split-out; inherent"},
    {"name": "serial2", "reason": "serial transport feature of the dev-tunnels SDK; SDK-mandated"},
    {"name": "signal-hook", "reason": "POSIX signal handling; platform FFI"},
    {"name": "signal-hook-registry", "reason": "POSIX signal registry; platform FFI"},
    {"name": "simd-adler32", "reason": "SIMD Adler-32 (png/flate2); unsafe for vectorization"},
    {"name": "socket2", "reason": "raw socket FFI (hyper/reqwest); platform FFI"},
    {"name": "stable_deref_trait", "reason": "stable-deref marker (yoke); inherent"},
    {"name": "sync_wrapper", "reason": "Sync wrapper used by hyper/tower; inherent"},
    {"name": "system-configuration", "reason": "macOS network-config FFI for native-tls trust; platform FFI"},
    {"name": "tokio-native-tls", "reason": "native-tls glue pulled by the dev-tunnels SDK tungstenite relay; SDK-mandated"},
    {"name": "tokio-stream", "reason": "Stream adapters over tokio; inherent"},
    {"name": "toml_edit", "reason": "format-preserving TOML (config); inherent"},
    {"name": "toml_parser", "reason": "TOML parser backend (winnow); inherent"},
    {"name": "tracing", "reason": "tracing facade macros; inherent"},
    {"name": "try-lock", "reason": "single-owner lock primitive (hyper); inherent"},
    {"name": "tungstenite", "reason": "websocket transport inside the dev-tunnels SDK relay; SDK-mandated"},
    {"name": "utf8_iter", "reason": "UTF-8 iteration (icu); inherent"},
    {"name": "uuid", "reason": "UUID formatting/parsing; inherent"},
    {"name": "winnow", "reason": "parser-combinator backend (toml); inherent"},
    {"name": "zerocopy-derive", "reason": "zerocopy proc-macro support crate; inherent"},
    {"name": "zmij", "reason": "IANA tzdb parser backing jiff; inherent"}
  ]
}