ci: remove cargo-deny (#464)

.cargo/audit.toml

@@ -0,0 +1,13 @@
+[advisories]
+ignore = [
+    # quick-xml < 0.41.0 can consume excessive resources when parsing
+    # untrusted XML. RustNet only receives it through wayland-scanner, a
+    # build-time tool that parses trusted protocol XML bundled with the crate.
+    # wayland-scanner 0.31.8 currently pins quick-xml ^0.38.3.
+    "RUSTSEC-2026-0194",
+    "RUSTSEC-2026-0195",
+]
+
+[output]
+deny = ["yanked"]
+quiet = false

.github/workflows/rust.yml

@@ -11,7 +11,7 @@ on:
       - 'build.rs'
       - 'benches/**'
       - 'Dockerfile'
-      - 'deny.toml'
+      - '.cargo/audit.toml'
       - '.github/workflows/rust.yml'
   pull_request:
     branches: [ "main" ]
@@ -23,7 +23,7 @@ on:
       - 'build.rs'
       - 'benches/**'
       - 'Dockerfile'
-      - 'deny.toml'
+      - '.cargo/audit.toml'
       - '.github/workflows/rust.yml'
   workflow_dispatch:
 
@@ -53,13 +53,12 @@ jobs:
       run: cargo build --workspace --all-targets --verbose
     - name: Run tests
       run: cargo test --workspace --verbose
-    - name: Run cargo-deny
-      # Checks RustSec advisories and yanked crates (yanked = "deny" in
-      # deny.toml, so a withdrawn dependency pinned in Cargo.lock is caught),
-      # plus license policy, wildcard bans, and registry sources.
-      uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
-      with:
-        command: check
+    - name: Install cargo-audit
+      run: cargo install cargo-audit --locked
+    - name: Run security audit
+      # Fail the build on advisories and on yanked crates so a withdrawn
+      # dependency (e.g. a yanked release pinned in Cargo.lock) is caught in CI.
+      run: cargo audit
 
   docker:
     runs-on: ubuntu-latest

.github/workflows/security.yml

@@ -1,10 +1,8 @@
 name: Security audit
 
-# Scheduled advisory check against the committed Cargo.lock. PR/push CI
-# (rust.yml) already runs the full `cargo deny check`, but new RustSec
-# advisories can be published against an unchanged lockfile — this catches
-# those without requiring a push. Licenses/bans/sources can only change with
-# a lockfile change, so the scheduled job checks advisories only.
+# Scheduled dependency check against the committed Cargo.lock. PR/push CI
+# (rust.yml) already runs `cargo audit`, but new RustSec advisories and yanks
+# can affect an unchanged lockfile. This catches them without requiring a push.
 
 on:
   schedule:
@@ -19,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
       - name: Check RustSec advisories
-        uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
-        with:
-          command: check advisories
+        run: cargo audit

CONTRIBUTING.md

@@ -52,9 +52,9 @@ Before submitting a PR, please ensure:
   ```bash
   cargo fmt
   ```
-- **Security audit**: Check for known vulnerabilities and policy violations in dependencies
+- **Security audit**: Check for known vulnerabilities in dependencies
   ```bash
-  cargo deny check
+  cargo audit
   ```
 
 ## CI Checks

CONTRIBUTING.zh-CN.md

@@ -52,9 +52,9 @@ RustNet 追求小而快。并不是每个协议或功能都适合放在核心工
   ```bash
   cargo fmt
   ```
-- **安全审计**：检查依赖中的已知漏洞和策略违规
+- **安全审计**：检查依赖中的已知漏洞
   ```bash
-  cargo deny check
+  cargo audit
   ```
 
 ## CI 检查<a id="ci-checks"></a>

SECURITY.md

@@ -308,7 +308,7 @@ For this reason, running with fine-grained capabilities (`setcap cap_net_raw=eip
 RustNet takes the following measures to protect against supply chain attacks:
 
 - **Dependency lockfile**: `Cargo.lock` is committed to the repository, pinning all transitive dependency versions and recording source checksums. This prevents silent version upgrades.
-- **Security audit**: `cargo deny check` runs in CI on every push and pull request, checking dependencies against the RustSec Advisory Database and enforcing license, source, and wildcard-version policies (`deny.toml`). A scheduled daily workflow re-checks advisories against the committed `Cargo.lock`, so newly published advisories surface without requiring a push.
+- **Security audit**: `cargo audit` runs in CI on every push and pull request, checking dependencies against the RustSec Advisory Database and detecting yanked releases. A scheduled daily workflow re-checks the committed `Cargo.lock`, so newly published advisories and yanks surface without requiring a push.
 - **CI action pinning**: All GitHub Actions are pinned by commit SHA (not tags), preventing tag-rewriting attacks on upstream actions.
 - **Conservative dependency policy**: New dependencies require justification and are reviewed for maintenance status and security track record (see `CONTRIBUTING.md`).
 - **Build-time integrity**: The Windows Npcap SDK download in `build.rs` is verified against a hardcoded SHA256 checksum.

SECURITY.zh-CN.md

@@ -303,7 +303,7 @@ Landlock（Linux）和 Seatbelt（macOS）即使在 RustNet 以 root（UID 0）
 RustNet 采取以下措施防护供应链攻击：
 
 - **依赖锁文件**：`Cargo.lock` 已提交到仓库，固定所有传递依赖版本并记录源校验和。这防止静默版本升级。
-- **安全审计**：`cargo deny check` 在每次 push 和 pull request 时于 CI 中运行，对照 RustSec Advisory Database 检查依赖，并强制执行许可证、来源和通配符版本策略（`deny.toml`）。一个每日定时工作流会针对已提交的 `Cargo.lock` 重新检查安全公告，因此新发布的公告无需 push 即可被发现。
+- **安全审计**：`cargo audit` 在每次 push 和 pull request 时于 CI 中运行，对照 RustSec Advisory Database 检查依赖并检测已撤回的版本。一个每日定时工作流会重新检查已提交的 `Cargo.lock`，因此新发布的公告和版本撤回无需 push 即可被发现。
 - **CI action 固定**：所有 GitHub Actions 均通过 commit SHA（而非标签）固定，防止对上游 action 的标签重写攻击。
 - **保守的依赖策略**：新依赖需要说明理由，并审查其维护状态和安全记录（参见 [CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md)）。
 - **构建时完整性**：Windows Npcap SDK 下载在 `build.rs` 中对照硬编码的 SHA256 校验和进行验证。

deny.toml

@@ -1,54 +0,0 @@
-# cargo-deny configuration (https://embarkstudios.github.io/cargo-deny/)
-# Checked in CI: full `cargo deny check` on push/PR (rust.yml) and a daily
-# advisories-only check (security.yml) so new RustSec advisories against the
-# committed Cargo.lock surface without requiring a push.
-
-[graph]
-# Include all features and the default target list (all targets), so the
-# windows/macos dependency trees shipped in releases are covered too.
-all-features = true
-
-[advisories]
-# Vulnerabilities and unsound advisories are errors by default (v2 semantics).
-# Deny yanked crates so a withdrawn dependency pinned in Cargo.lock is caught.
-yanked = "deny"
-ignore = [
-    # quick-xml < 0.41.0 unbounded-allocation DoS when parsing untrusted XML.
-    # Only reachable via wayland-scanner (a build-time proc-macro) parsing the
-    # trusted, crate-bundled Wayland protocol XML files to generate code; it
-    # never parses attacker-controlled input at runtime. No upgrade path yet:
-    # wayland-scanner 0.31.8 pins quick-xml ^0.38.3. Revisit when wayland-scanner
-    # relaxes the requirement so quick-xml can move to >=0.41.0.
-    "RUSTSEC-2026-0194",
-    "RUSTSEC-2026-0195",
-]
-
-[licenses]
-# Workspace license is Apache-2.0. Allow-list derived from the locked
-# dependency tree; extend only after reviewing the new license.
-allow = [
-    "Apache-2.0",
-    "Apache-2.0 WITH LLVM-exception", # wasi
-    "MIT",
-    "BSD-2-Clause",                   # satisfies libbpf-rs "LGPL-2.1-only OR BSD-2-Clause"
-    "BSD-3-Clause",
-    "ISC",                            # ring (Apache-2.0 AND ISC), untrusted
-    "Zlib",                           # foldhash, zlib-rs
-    "0BSD",                           # adler2
-    "BSL-1.0",                        # ryu
-    "Unicode-3.0",                    # unicode-ident
-    "MIT-0",                          # ppmd-rust (via zip, build-dep)
-    "bzip2-1.0.6",                    # libbz2-rs-sys (via zip, build-dep)
-]
-confidence-threshold = 0.8
-
-[bans]
-# Duplicate versions are common in this tree (e.g. windows-sys); keep as a
-# warning rather than blocking PRs on transitive version skew.
-multiple-versions = "warn"
-wildcards = "deny"
-
-[sources]
-unknown-registry = "deny"
-unknown-git = "deny"
-allow-registry = ["https://github.com/rust-lang/crates.io-index"]