Sometime within the last day or so, cargo audit has begun to fail with this error:
> cargo-audit audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
error: error loading advisory database: parse error: error parsing /home/somers/.cargo/advisory-db/crates/gix-worktree-state/RUSTSEC-2025-0001.md: parse error: TOML parse error at line 13, column 6
|
13 | os = [
| ^
Unrecognized value 'nuttx' for target_os
Environment
FreeBSD amd64, both 15.0-CURRENT and 14.2-RELEASE, both in an environment with a rustup toolchain installed and in an environment without, and using cargo-audit from the OS package, which is built with Rust 1.83.0. I cannot reproduce the problem if I install the tool with cargo install cargo-audit. But I can if I install it with cargo install --locked cargo-audit, and I can reproduce it in Debian 12, too.
Steps to Reproduce
FreeBSD
$ pkg install cargo-audit
$ cd /path/to/literally/anywhere
$ cargo-audit audit
Linux
$ cargo install --locked cargo-audit
$ cd /path/to/literally/anywhere
$ cargo audit
Analysis
The main difference between cargo install and the FreeBSD package build system is that the latter includes a cargo update (unless you specify --locked. So I think that cargo-audit's Cargo.lock file has some dependency that needs to be updated, but I don't know which.
Sometime within the last day or so,
cargo audithas begun to fail with this error:Environment
FreeBSD amd64, both 15.0-CURRENT and 14.2-RELEASE, both in an environment with a rustup toolchain installed and in an environment without, and using
cargo-auditfrom the OS package, which is built with Rust 1.83.0. I cannot reproduce the problem if I install the tool withcargo install cargo-audit. But I can if I install it withcargo install --locked cargo-audit, and I can reproduce it in Debian 12, too.Steps to Reproduce
FreeBSD
Linux
Analysis
The main difference between
cargo installand the FreeBSD package build system is that the latter includes acargo update(unless you specify--locked. So I think that cargo-audit's Cargo.lock file has some dependency that needs to be updated, but I don't know which.