Setup cargo audit (or similar) to report dependency CVEs and validate license

[howardjohn]

No description provided.

[thesurlydev]

I'm happy to add this once there's CI. Is the plan to use GitHub Actions or something else?

[howardjohn]

We use Prow. The job config is in https://github.com/istio/test-infra/blob/master/prow/config/jobs/ztunnel.yaml; its already running on the repo. So quick presubmits can be added to make presubmit; if we want to add more jobs in parallel theycan be added to that YAML.

For CVEs we probably dont want block PRs so can make that a nightly job. License checking could be a presubmit (assuming its fast?)

[stevenctl]

We can use cargo audit (or similar) to automatically notify us of CVEs in our dependencies.

The process of handing reports and eventually patching will be shared with the rest of Istio.

Rust/library specific CVEs will be included in Istio’s security bulletins.

[keithmattix]

@hypernovasunnix is taking care of this, but I can't assign her since she's not a member of the Istio org yet

[stevenctl]

OOO - paused

[stevenctl]

@keithmattix any update? And we should add @hypernovasunnix via istio/community after she submits 1 pr

[stevenctl]

PR incoming, no longer paused.

[SkyfireFrancisZ]

PR out for review

[howardjohn]

Logic is merge, getting it into prow is in istio/tools#2330