Repository: EmbarkStudios/cargo-deny (language: rust)

Issue:
Cannot use SSH to fetch advisory DB
**Describe the bug**
If an SSH Git URL is provided for the advisory DB, cargo-deny exits with "error: advisory database url is not https".

**To Reproduce**
Steps to reproduce the behavior:
1. Set something like `db-urls = ["ssh://git@git.yourcompany.com/yourcompany/rustsec-advisory-db.git"]` in `deny.toml`
2. Run `cargo deny`
3. See error

**Expected behavior**
The advisory DB was cloned over SSH.

**Additional context**
The check is here: https://github.com/EmbarkStudios/cargo-deny/blob/main/src/advisories/cfg.rs#L131

This crate seems to delegate cloning Git repositories to the `git2` crate (update: or, since #420, optionally the Git executable) so I see no reason why the SSH clone would not work if this check was removed.


Discussion / hints:
That code was added specifically because rustsec [doesn't support non-https urls](https://github.com/rustsec/rustsec/blob/839faadd903885e43520879ea5886e5380422de8/rustsec/src/repository/git/repository.rs#L49-L55). Please file an issue on rustsec if you want this supported in cargo-deny.

Fix patch:
diff --git a/src/advisories/cfg.rs b/src/advisories/cfg.rs
index f10dc25f..1a3b1552 100644
--- a/src/advisories/cfg.rs
+++ b/src/advisories/cfg.rs
@@ -130,14 +130,6 @@ impl crate::cfg::UnvalidatedConfig for Config {
                         .with_labels(vec![Label::secondary(cfg_file, url.span.clone())]),
                 );
             }
-
-            if url.value.scheme() != "https" {
-                diags.push(
-                    Diagnostic::error()
-                        .with_message("advisory database url is not https")
-                        .with_labels(vec![Label::secondary(cfg_file, url.span.clone())]),
-                );
-            }
         }
 
         ValidConfig {


Test patch: