ci: switch audit test from using cargo-audit to cargo-deny

`cargo-audit` goes through all crates in the Cargo.lock which includes
crate which are pulled as transitive dependencies of some crates but not
used in any of our binaries. Switching to `crago-deny` fixes this since
it only checks crates which are a part of our dependencies tree for our
binaries.

Similar to `cargo-audit`, we need to install `cargo-deny` each time to
avoid a possibility of it breaking if advisory database suddenly updates
the format it uses. But for the sake of speed, we now install with
`--debug` flag to install debug binary (install in this case means
"compile"). This saves time and does not affect the result.

`cargo-audit` is also used in the license check test, but that test is
fine using the potentially older version of the tool from the devctr.

Signed-off-by: Egor Lazarchuk <yegorlz@amazon.co.uk>

Author: ShadowCurse

deny.toml

@@ -1,3 +1,21 @@
+[graph]
+all-features = true
+
+[advisories]
+yanked = "deny"
+unmaintained = "all"
+unsound = "all"
+ignore = [
+    # `rand` unsoundness when a custom logger re-enters `rand::rng()`/`thread_rng()`
+    # during ThreadRng reseeding. Firecracker is not affected:
+    # - uuid (1.23.0): does not enable `fast-rng` or `rng-rand` features, so it uses
+    #   `getrandom` directly and never calls into rand.
+    # - proptest: uses rand 0.9 with `default-features = false` and does not enable
+    #   the `thread_rng` feature, so the affected functions are not compiled in.
+    # See https://rustsec.org/advisories/RUSTSEC-2026-0097.html
+    "RUSTSEC-2026-0097",
+]
+
 [licenses]
 version = 2
 allow = [

tests/integration_tests/security/test_sec_audit.py

@@ -6,11 +6,12 @@
 
 import pytest
 
+from framework import utils
+from framework.defs import FC_WORKSPACE_DIR
 from framework.ab_test import (
     git_ab_test_host_command_if_pr,
     set_did_not_grow_comparator,
 )
-from framework.utils import CommandReturn
 from framework.utils_cpuid import CpuVendor, get_cpu_vendor
 
 
@@ -23,19 +24,36 @@ def test_cargo_audit():
     Run cargo audit to check for crates with security vulnerabilities.
     """
 
-    def set_of_vulnerabilities(output: CommandReturn):
-        output = json.loads(output.stdout)
-
-        return set(
-            frozenset(vulnerability)
-            for vulnerability in output["vulnerabilities"]["list"]
-        ).union(
-            frozenset(warning)
-            for warning_kind, warnings in output["warnings"].items()
-            for warning in warnings
-        )
+    def set_of_vulnerabilities(output: utils.CommandReturn):
+        # The `stdout` will contain one `json` payload per line
+        findings = set()
+        for line in output.stderr.splitlines():
+            line = line.strip()
+            if not line:
+                continue
+            entry = json.loads(line)
+            # There is also `summary` type, which is of not interest for us
+            if entry["type"] != "diagnostic":
+                continue
+            fields = entry["fields"]
+            advisory = fields.get("advisory") or {}
+            # Identify a finding by its code, advisory id and affected crate;
+            # Findings without an advisory (e.g. yanked crates) fall back to
+            # the crate from the dependency graph.
+            krate = (fields.get("graphs") or [{}])[0].get("Krate", {})
+            findings.add(
+                (
+                    fields.get("code"),
+                    advisory.get("id"),
+                    advisory.get("package") or krate.get("name"),
+                )
+            )
+        return findings
+
+    utils.run_cmd("cargo install --locked cargo-deny --debug")
+    toml_file = FC_WORKSPACE_DIR / "Cargo.toml"
 
     git_ab_test_host_command_if_pr(
-        "cargo install --locked cargo-audit && cargo audit --deny warnings -q --json",
+        f"cargo deny --manifest-path {toml_file} -f json check advisories",
         comparator=set_did_not_grow_comparator(set_of_vulnerabilities),
     )