Remove Cargo Audit Ignores

[q9f]

Task summary

• remove the following audit ignores:

  args: --ignore RUSTSEC-2020-0159 --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2021-0130 --ignore RUSTSEC-2022-0009
  

• https://rustsec.org/advisories/RUSTSEC-2020-0071
• https://rustsec.org/advisories/RUSTSEC-2020-0159 done
• https://rustsec.org/advisories/RUSTSEC-2021-0130
• https://rustsec.org/advisories/RUSTSEC-2022-0009 done

TL;DR

• replace chrono with time if possible move from chrono to time crate #1426
• upgrade libp2p to 0.45.1 everywhere crates: bump libp2p to 0.42.2 #1420

Fix for RUSTSEC-2020-0071

• Potential segfault in the time crate
• Patched: time, >=0.2.23
• To do: impossible to patch because chrono (see below) depends on time 0.1; replace chrono with time if possible

Fix for RUSTSEC-2020-0159

• Potential segfault in chrono's localtime_r invocations
• Patched: not available
• To do: replace chrono with time if possible

Fix for RUSTSEC-2021-0130

• Use after free in lru crate
• Patched: lru, >=0.7.1
• To do: nothing; we already upgraded lru everywhere, it still gets pulled in by old libp2p dependencies; upgrade libp2p to 0.42 everywhere

Fix for RUSTSEC-2022-0009

• Failure to verify the public key of a SignedEnvelope against the PeerId in a PeerRecord
• Patched: libp2p-core, >=0.31.1
• To do: upgrade libp2p to 0.42 everywhere

[q9f]

According to the core developer of chrono this is unfixable, see chronotope/chrono#499 (comment)

It took quite a bit to figure out what was going on, and if my understanding is correct this vulnerability is unfixable [...]

The most viable option on our end is to remove chrono entirely (replace it with time?) and try to upgrade all time dependencies to >= 0.2.23

[LesnyRumcajs]

After #1717 is merged, only RUSTSEC-2020-0071 will remain. We'll need to update jsonwebtoken crate (it will fix this dependency path) and either replace tide with something that doesn't use this chrono version or wait till it will fix itself eventually. This seems to be on the right path as unfixable chrono is getting fixed. https://github.com/chronotope/chrono/releases/tag/v0.4.20-rc.1 . That being said, we'll still need to ignore this audit error until it's updated to 0.5 (it's not even released yet) in tide.

[LesnyRumcajs]

I'll close this issue in favour of #1761.