tari-project / tari / 38579576051

77%

Build Type

push

github

Committed by web-flow

Commit Message

fix(common): replace serde_yaml with serde-saphyr to drop unsafe-libyaml (#8116)

## Description

Removes `unsafe-libyaml` (RUSTSEC-2024-0449, unmaintained) from the
dependency tree.

It came in only through `serde_yaml` (itself deprecated), which had two
users:

- `tari_common`, directly, to parse `log4rs.yml`.
- `log4rs`, through its `yaml_format` feature, enabled in `tari_common`,
the node, console wallet, miner, peer sync and wallet FFI.

`tari_common` already parses the log config into log4rs's `RawConfig`
itself and calls `log4rs::init_raw_config`, so log4rs's own YAML loader
was never called. `yaml_format` was only pulling in `serde_yaml`.

Changes:

- **`common/src/logging.rs`**
- New `from_yaml` helper parses with
[`serde-saphyr`](https://crates.io/crates/serde-saphyr), the safe-Rust
parser the advisory recommends. Both the appender path check and the
final `RawConfig` go through it, so both still see the same document.
- Repeated keys keep the last value (`DuplicateKeyPolicy::LastWins`), as
`serde_yaml` did. serde-saphyr's default would reject them, which would
break existing user configs.
- `has_only_string_keys` now checks log4rs's `serde_value::Value`
directly instead of converting to `serde_yaml::Value` first. It is
slightly stricter: a key wrapped in an option or newtype is now refused
outright.
- **Manifests**: drops `serde_yaml` and every `yaml_format` feature. In
wallet FFI, `"default"` becomes `"all_components", "config_parsing"`,
which is log4rs's default minus `yaml_format`. Adds `serde-saphyr`
(deserialize only) and `serde-value` to `tari_common`.
- **Tests**: `embedded_default_log_configs_stay_in_the_log_dir` now also
parses every bundled sample config with the new parser and builds it
with `log4rs::config::create_raw_config`. A log4rs dev-dependency with
`all_components` lets the test build every appender kind.
- **`supply-chain/config.toml`**: drops the exemptions for `serde_yaml`
and `unsafe-libyaml` and adds exemptions for `... (continued)

Coverage Stats

21 of 23 new or added lines in 1 file covered. (91.3%)

245 existing lines in 17 files now uncovered.

126750 of 168541 relevant lines covered (75.2%)

320285.26 hits per line