[HackingRepo]

Hi, i did that because i see mainteners merge renovabot prs just in hours, if there was a supply chain incident then will progogate, because mainteners a lot frustrated by pinning actions and merge a renovabot pr after days, instead that is the solution a maintener can merge an update safely using that, very easy it outputs the supply chain score in curcilar graph, to see is the update safe or no, before merging, i finally retrieved a solution for that repo, since mainteners frustrated by classical supply chain defenses like pinning deps and github actions and do'nt merge a renovabot pr before 1 day, that was actually frustrating that will be optimal for mainteners while balancing and maintening supply chain security for free no cost and usability too

[HackingRepo]

@cakebaker can you take a look in that? i appreciate it

[github-actions]

GNU testsuite comparison:

Skip an intermittent issue tests/misc/usage_vs_getopt (fails in this run but passes in the 'main' branch)

[HackingRepo]

hi, @cakebaker

can you take a look in that and merge it and review it? i appreciate it

[HackingRepo]

hi, @sylvestre can you review that pr, i appreciate it, and thank's for your effort

[sylvestre]

Sorry but I don't understand this PR. I don't know what is socketdev

[HackingRepo]

read https://github.com/SocketDev/action to see, the meaning, i mean socket firewall, @sylvestre

the explanation i can say, by example someone add a new dep or crate or whatever callled, socket firewall will evaluate the supply chain security score and maintenance score and quality and license and vulnerability and also for renovabot update, if any crate of one used ever compromised and ships malware socket firewall will say supply chain security very low score and then that was a malware incident if the score 75% or heigher then safe to merge

[codspeed]

Merging this PR will not alter performance

✅ 172 untouched benchmarks
⏩ 213 skipped benchmarks¹

---

_{Comparing HackingRepo:patch-11 (496a5c4) with main (ef50d8b)}

Footnotes

1. 213 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sylvestre]

I am still unfortunately not very convinced by this

[HackingRepo]

why it is important for supply chain security since the repo have no pinning, a supply chain attack in these deps since uutils use dozens of deps, if just one compromised, then these utilities will serve malware?

[sylvestre]

what does firewall-free mean here? please document the why

[HackingRepo]

@sylvestre, The term firewall-free (short for Socket Firewall Free) refers to the Free Edition of Socket's security tool. It means zero-configuration and entirely free security, requiring no API keys, no secrets management, and no account sign-ups to run in this repository.

[HackingRepo]

@sylvestre please merge that, thank's

[oech3]

We already have audit CI, 2 are not needed.

[HackingRepo]

however that one better, and that company is the most global supply chain defense company their action better than us

[sylvestre]

sorry but we already run cargo-deny/audit on the deps, and this mode only blocks known-bad crates on cargo fetch, so i don't think it adds enough to keep another third-party action

[HackingRepo]

no @sylvestre, socket ai can catch zero day typosquats and compromises, no cargo deny and audit is not encought please reoepn this, it have socket ai

[HackingRepo]

the difference betwene the two cargo deny and audit good pairing it with socketdev workflow

Dimension	Socket Firewall	cargo-audit / cargo-deny
Primary Approach	Behavioral Analysis & Runtime Interception	Static Analysis & Vulnerability Database Lookup
Analysis Type	Deep Semantic Analysis + Network/FS Monitoring	Dependency Tree Linting & Advisory Database Matching
Data Source	Socket's proprietary threat intel & telemetry	GitHub Advisory Database & Rust Sec Advisory Database
Interception Point	Real-time (blocks active network/file system anomalies)	CI Pipeline Gate / Pre-build CLI check
Build Script (build.rs) Protection	Active. Monitors and blocks malicious telemetry or file access during compilation.	Passive. Only flags if the crate containing the script has a known advisory.
Zero-Day/Unreported Malware	High Detection. Catches new, unclassified malicious behaviors immediately.	No Detection. Blind to zero-days until a CVE/advisory is formally published.

This the difference, for you understand so integrating both tools is good, this is the difference, thank's for reopening it,

[sylvestre]

could you please fix the jobs ?

[HackingRepo]

the failure of openbsd test seems unrelated just intermitten, compiler error the pr just adds the socketdev firewall workflow

[oech3]

Squash commits at next time.