fix(deps, security): temporarily ignore ed25519-dalek security vulnerability

[pront]

Currently our vdev check deny check fails with:

error[vulnerability]: Double Public Key Signing Function Oracle Attack on `ed25519-dalek`
    ┌─ /Users/pavlos.rontidis/CLionProjects/vector/Cargo.lock:241:1
    │
241 │ ed25519-dalek 1.0.1 registry+https://github.com/rust-lang/crates.io-index
    │ ------------------------------------------------------------------------- security vulnerability detected
    │
    = ID: RUSTSEC-2022-0093
    = Advisory: https://rustsec.org/advisories/RUSTSEC-2022-0093
    = Versions of `ed25519-dalek` prior to v2.0 model private and public keys as
      separate types which can be assembled into a `Keypair`, and also provide APIs
      for serializing and deserializing 64-byte private/public keypairs.

      Such APIs and serializations are inherently unsafe as the public key is one of
      the inputs used in the deterministic computation of the `S` part of the signature,
      but not in the `R` value. An adversary could somehow use the signing function as
      an oracle that allows arbitrary public keys as input can obtain two signatures
      for the same message sharing the same `R` and only differ on the `S` part.

      Unfortunately, when this happens, one can easily extract the private key.

      Revised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled
      private/public keypair as signing input, except as part of specially labeled
      "hazmat" APIs which are clearly labeled as being dangerous if misused.
    = Announcement: https://github.com/MystenLabs/ed25519-unsafe-libs
    = Solution: Upgrade to >=2 (try `cargo update -p ed25519-dalek`)
    = ed25519-dalek v1.0.1
      └── nkeys v0.3.1
          ├── async-nats v0.31.0
          │   └── vector v0.32.0
          └── vector v0.32.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
Error: command: cd "/Users/pavlos.rontidis/CLionProjects/vector" && "cargo" "deny" "--log-level" "error" "--all-features" "check" "all"
  failed with exit code: 1

Ignoring this vulnerability until this wasmCloud/nkeys#20 is fixed.

[netlify]

✅ Deploy Preview for vector-project canceled.

Name	Link
🔨 Latest commit	2329397
🔍 Latest deploy log	https://app.netlify.com/sites/vector-project/deploys/64da9ecfc3c8ee0008c02dfc

[netlify]

✅ Deploy Preview for vrl-playground canceled.

Name	Link
🔨 Latest commit	2329397
🔍 Latest deploy log	https://app.netlify.com/sites/vrl-playground/deploys/64da9ecf1a51fd0007d53ed3

[datadog-vectordotdev]

Datadog Report

Branch report: pront/path-ed25519-dalek
Commit report: 1e26215

✅ vector: 0 Failed, 0 New Flaky, 1935 Passed, 0 Skipped, 1m 18.98s Wall Time

[github-actions]

Regression Detector Results

Run ID: d4b67402-458e-4402-91a7-976c6320c156
Baseline: b0c89ab
Comparison: 1b90398
Total vector CPUs: 7

Explanation

A regression test is an integrated performance test for vector in a repeatable rig, with varying configuration for vector. What follows is a statistical summary of a brief vector run for each configuration across SHAs given above. The goal of these tests are to determine quickly if vector performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.

experiment	goal	Δ mean %	Δ mean % CI	confidence
syslog_log2metric_humio_metrics	ingress throughput	+3.36	[+3.28, +3.44]	100.00%
otlp_http_to_blackhole	ingress throughput	+2.62	[+2.45, +2.80]	100.00%
syslog_regex_logs2metric_ddmetrics	ingress throughput	+2.41	[+2.10, +2.73]	100.00%
enterprise_http_to_http	ingress throughput	+2.02	[+1.92, +2.11]	100.00%
datadog_agent_remap_datadog_logs_acks	ingress throughput	+1.86	[+1.73, +1.98]	100.00%
datadog_agent_remap_datadog_logs	ingress throughput	+1.62	[+1.49, +1.75]	100.00%
fluent_elasticsearch	ingress throughput	+1.06	[+0.83, +1.30]	100.00%
file_to_blackhole	egress throughput	+0.98	[+0.11, +1.85]	85.23%
socket_to_socket_blackhole	ingress throughput	+0.64	[+0.61, +0.68]	100.00%
datadog_agent_remap_blackhole_acks	ingress throughput	+0.58	[+0.49, +0.67]	100.00%
http_to_http_noack	ingress throughput	+0.51	[+0.42, +0.61]	100.00%
syslog_splunk_hec_logs	ingress throughput	+0.31	[+0.26, +0.36]	100.00%
otlp_grpc_to_blackhole	ingress throughput	+0.30	[+0.23, +0.38]	100.00%
http_text_to_http_json	ingress throughput	+0.28	[+0.17, +0.38]	99.95%
http_to_http_json	ingress throughput	+0.04	[-0.02, +0.10]	60.51%
splunk_hec_to_splunk_hec_logs_noack	ingress throughput	+0.00	[-0.10, +0.11]	3.88%
splunk_hec_to_splunk_hec_logs_acks	ingress throughput	-0.00	[-0.12, +0.11]	1.87%
splunk_hec_indexer_ack_blackhole	ingress throughput	-0.00	[-0.13, +0.12]	3.00%
http_to_s3	ingress throughput	-0.11	[-0.31, +0.09]	50.91%
syslog_loki	ingress throughput	-0.30	[-0.35, -0.25]	100.00%
syslog_humio_logs	ingress throughput	-0.55	[-0.65, -0.46]	100.00%
datadog_agent_remap_blackhole	ingress throughput	-0.67	[-0.76, -0.59]	100.00%
syslog_log2metric_splunk_hec_metrics	ingress throughput	-0.96	[-1.08, -0.84]	100.00%
http_to_http_acks	ingress throughput	-1.19	[-2.50, +0.11]	75.85%
splunk_hec_route_s3	ingress throughput	-2.86	[-3.29, -2.43]	100.00%

[thomastaylor312]

Heads up @pront and @jszwedko, nkeys 0.3.2 is out with the dalek upgrade: https://crates.io/crates/nkeys/0.3.2

[jszwedko]

Thanks @thomastaylor312 ! I opened #18264 to bump.