rust-supply-chain

What this skill does

# Rust Supply Chain & Quality Toolchain

> **Deep Knowledge**: Use `mcp__documentation__fetch_docs` with technology: `cargo-deny` or `rustsec`.

## Overview

Production Rust app needs:

| Tool | Concern |
|---|---|
| **cargo-deny** | License compliance, banned crates, advisory enforcement |
| **cargo-audit** | RustSec advisory DB lookup |
| **cargo-nextest** | Faster, more reliable test runner (parallel, retries) |
| **cargo-tarpaulin** / `llvm-cov` | Code coverage |
| **cargo-machete** | Detect unused dependencies |
| **cargo-outdated** | Find stale dependencies |
| **cargo-vet** | Mozilla-style audit attestations for transitive deps |
| **cargo-msrv** | Minimum supported Rust version detection |
| **cargo-binstall** | Install tools as binaries (faster than `cargo install`) |

For BHODL-style wallet apps: **all of these** in CI. No exceptions.

## Install

```bash
# Fast install via binstall (downloads pre-built binaries)
cargo install cargo-binstall
cargo binstall cargo-deny cargo-audit cargo-nextest cargo-tarpaulin \
    cargo-machete cargo-outdated cargo-vet cargo-msrv

# Or build from source (slower)
cargo install cargo-deny cargo-audit cargo-nextest cargo-tarpaulin \
    cargo-machete cargo-outdated cargo-vet
```

## cargo-deny — License + Bans + Advisories

`deny.toml` (project root):

```toml
[graph]
all-features = true
no-default-features = false

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"                                           # fail on yanked crates
ignore = [
    # Allowed exceptions with rationale
    # "RUSTSEC-2024-XXXX",  # reason: not exploitable in our use
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",                                   # for unicode-* crates
    "Zlib",
    "MPL-2.0",                                             # be careful, file-level copyleft
    "CC0-1.0",                                             # Bitcoin libs use this
    "Unlicense",                                           # public domain
    "0BSD",
]
confidence-threshold = 0.8

# Block GPL, AGPL — they'd virally infect a wallet codebase
# Reject by NOT listing them in `allow` (default deny)

[[licenses.exceptions]]
name = "ring"
allow = ["LicenseRef-ring"]                               # has its own license file

[bans]
multiple-versions = "warn"
deny = [
    { name = "openssl-sys", reason = "Use rustls instead" },
    { name = "native-tls", reason = "Use rustls instead" },
]
skip = [
    # Tolerate duplicates from common transitive deps
    { name = "syn", version = "1" },
    { name = "syn", version = "2" },
]
skip-tree = [
    # Don't trace into these for ban check
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []                                             # no random git deps
```

```bash
# Run all checks
cargo deny check

# Specific category
cargo deny check licenses
cargo deny check advisories
cargo deny check bans
cargo deny check sources

# In CI (exit non-zero on issues)
cargo deny --log-level error check
```

For BHODL-type wallet: **deny GPL/AGPL hard** — they'd require open-sourcing the whole app under matching license.

## cargo-audit — Advisory DB Lookup

```bash
# Update advisory DB
cargo audit fetch

# Run audit
cargo audit

# JSON output
cargo audit --json | jq '.vulnerabilities'

# Allow some advisories with rationale
cargo audit --ignore RUSTSEC-2024-0001
```

`cargo-audit` is lighter-weight than `cargo deny check advisories` — use both: cargo-deny for policy enforcement, cargo-audit for quick scans.

## cargo-nextest — Faster Test Runner

```bash
# Drop-in replacement for `cargo test`
cargo nextest run

# Run specific tests
cargo nextest run wallet::tests::insert
cargo nextest run --package bdk-ffi

# With retry on flake
cargo nextest run --retries 2

# JUnit output for CI
cargo nextest run --profile ci

# List all tests without running
cargo nextest list
```

Configuration `.config/nextest.toml`:

```toml
[profile.default]
retries = 0
fail-fast = true
test-threads = "num-cpus"
slow-timeout = { period = "60s", terminate-after = 2 }

[profile.ci]
retries = 2
fail-fast = false
test-threads = 4
junit = { path = "target/nextest/junit.xml" }
status-level = "all"
final-status-level = "slow"
```

Why nextest:
- 2-3x faster than cargo test (better parallelism)
- Per-test process isolation (uncovers test pollution bugs)
- Retry support for flaky tests
- JUnit XML output for CI dashboards
- Better failure summaries

## cargo-tarpaulin (Linux) — Code Coverage

```bash
cargo install cargo-tarpaulin

# Run with coverage
cargo tarpaulin --workspace --out Xml --output-dir coverage

# HTML report
cargo tarpaulin --workspace --out Html --output-dir coverage
open coverage/tarpaulin-report.html

# Exclude generated code
cargo tarpaulin --exclude-files 'target/*' '*/build.rs'

# Per-test (slower but more accurate)
cargo tarpaulin --workspace --line --branch
```

For Linux only. For macOS/Windows use llvm-cov.

## llvm-cov (Cross-Platform) — Code Coverage

```bash
cargo install cargo-llvm-cov

cargo llvm-cov --workspace --html
cargo llvm-cov --workspace --lcov --output-path lcov.info     # for Codecov

# Combined with nextest
cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
```

Works on macOS, Windows, Linux. **Recommended for cross-platform projects.**

## cargo-machete — Unused Deps

```bash
cargo install cargo-machete

cargo machete                                              # list unused
cargo machete --fix                                         # auto-remove

# Skip known false positives
# .cargo/machete.toml
# ignored = ["serde_derive"]
```

Removes dead deps → faster builds, smaller attack surface.

## cargo-outdated — Stale Deps

```bash
cargo install cargo-outdated

cargo outdated                                              # show outdated
cargo outdated --workspace --depth 1                        # direct deps only
cargo outdated --exit-code 1                                # CI: fail if outdated
```

Tip: don't blindly upgrade — check changelogs first, especially for crypto/network crates.

## cargo-vet — Audit Attestations

Mozilla-developed: each org curates a list of crate versions audited (by them or by trusted parties).

```bash
cargo install cargo-vet

cargo vet init
cargo vet                                                   # checks all deps audited
cargo vet inspect <crate> <version>                         # opens diff to inspect
cargo vet certify <crate> <version>                         # mark as audited
```

Exchange `audit.toml` between orgs to share trust. Used by Mozilla, Embark, Bytecode Alliance.

For BHODL: probably overkill for a single-team OSS project — but if scaling to a team or going commercial, adopt.

## cargo-msrv — Minimum Supported Rust Version

```bash
cargo install cargo-msrv

cargo msrv find                                             # find minimum version that compiles
cargo msrv verify                                            # verify advertised MSRV
```

Useful for libraries with users on older toolchains.

## CI Integration — GitHub Actions

```yaml
# .github/workflows/quality.yml
name: Quality

on: [push, pull_request]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2

      - name: Format
        run: cargo fmt -- --check

      - name: Clippy
        run: cargo clippy --workspace --all-targets --all-features -- -D warnings

      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@main

      - name: Install audit tools
        run: cargo binstall -