build(deps): bump EmbarkStudios/cargo-deny-action from 1 to 2 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: EmbarkStudios/cargo-deny-action.

Updates EmbarkStudios/cargo-deny-action from 1 to 2

Release notes

Sourced from EmbarkStudios/cargo-deny-action's releases.

Release 2.0.0 - cargo-deny 0.16.0

Action

Added

• PR#78 added SSH support, thanks @​nagua!

Changed

• This release includes breaking changes in cargo-deny, so this release begins the v2 tag, using v1 will be stable but not follow future cargo-deny releases.

cargo-deny

Removed

• PR#681 finished the deprecation introduced in PR#611, making the usage of the deprecated fields into errors.

[advisories]

The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the ignore field can be used as before.

• vulnerability - Vulnerability advisories are now deny by default
• unmaintained - Unmaintained advisories are now deny by default
• unsound - Unsound advisories are now deny by default
• notice - Notice advisories are now deny by default
• severity-threshold - The severity of vulnerabilities is now irrelevant

[licenses]

The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either allow or exceptions.

• unlicensed - Crates whose license(s) cannot be confidently determined are now always errors. The clarify field can be used to help cargo-deny determine the license.
• allow-osi-fsf-free - The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.
• copyleft - The copyleft attribute is now irrelevant, only whether it is explicitly allowed.
• default - The default is now deny.
• deny - All licenses are now denied by default, this field added nothing.

Changed

• PR#685 follows up on PR#673, moving the fields that were added to their own separate bans.workspace-dependencies section. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are now deny instead of warn.

Fixed

• PR#685 resolved #682 by adding the include-path-dependencies field, allowing path dependencies to be ignored if it is false.

Release 1.6.3 - cargo-deny 0.14.21

Fixed

• PR#643 resolved #629 by making the hosted git (github, gitlab, bitbucket) org/user name comparison case-insensitive. Thanks @​pmnlla!
• PR#649 fixed an issue where depending on the same crate multiple times by using different cfg()/triple targets could cause features to be resolved incorrectly and thus crates to be not pulled into the graph used for checking.

[0.14.20] - 2024-03-23

Fixed

• PR#642 resolved #641 by pinning gix-transport (and its unique dependencies) to 0.41.2 as a workaround for cargo install not using the lockfile. See this issue for more information.

Release 1.6.2 - cargo-deny 0.14.19

Changed

• PR#639 updated tame-index to avoid an error if you don't used --locked.

... (truncated)

Commits

• 0895404 Move to v2 tag
• 10d8902 Bump to 0.16.0
• d425dbf Update .gitignore
• 53bface Update image base
• 3f8dc3e Add ability to fetch git dependecies in cargo via ssh (#78)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[daxpedda]

While I was fixing it so it works again, I've significantly refreshed our current deny.toml.

• Added atomics target feature to wasm32-unknown-unknown, which also includes more dependencies.
• Excluded dev-dependencies.
• Increased our confidence-threshold to 1.0.
• Enabled include-archives and interpreted to prevent pulling in any dependencies including weird files in their packaging, like executables or shell files.

Additionally, I made PRs to relevant dependencies that accidentally included shell files into their crate package: wasm-bindgen/wasm-bindgen#4046 and rust-mobile/android-activity#165.

To prevent the same happening to use, I also added package.include to Winit, as we are currently already including a shell file in our crate package. You can test this yourself by running cargo publish and look at the package.

[kchibisov]

, as we are currently already including a shell file in our crate package

what file is that? I'd assume it counted js/ts files, since I don't see any shell script inside winit.

[daxpedda]

, as we are currently already including a shell file in our crate package

what file is that? I'd assume it counted js/ts files, since I don't see any shell script inside winit.

Ah apologies, I was just rewording copy-pasted text from all the other repos that actually include shell files, it was late 😅.

Yes, it included the TS file, the JS file actually has to stay in.
But what we want to keep out is all the other things that aren't needed, e.g. .github folder, tests folder, CoC, CONTIBUTING.md, deny.toml, clippy.toml. Basically anything that isn't needed on the users computer to either compile the package or generate correct documentation locally should be stripped away.

[kchibisov]

tests folder

In general, tests must be shipped as well, since distributions do run the cargo test, so if we have some tests that actually do something there it all should be included.

In the end of the day you should ensure that all the basic commands, like cargo test work the same in the end archive.

[daxpedda]

In general, tests must be shipped as well, since distributions do run the cargo test, so if we have some tests that actually do something there it all should be included.

Do distributions get their package from crates.io?

[kchibisov]

Do distributions get their package from crates.io?

Yes, via archive URL and then they re-cache it. At least that's what I've seen and that's why debian requires the crate to be on crates.io IIRC.

Then they test it and repackage in their distro.

[daxpedda]

Done, I added the /tests directory to the package.

[kchibisov]

Just fyi, it's done by downloading the .crate file and then just extracting it
https://crates.io/api/v1/crates/winit/0.29.5/download
and then tar -xzvf it.

[kchibisov]

Can't we just include all of the src?

[daxpedda]

I changed it up a bit to handle the TS/JS stuff explicitly.

[kchibisov]

In general, the archive seems to work.