A library & tool for probing, parsing, and validating security.txt files as specified in RFC 9116 :rocket::books:
Home Page: https://crates.io/crates/sectxt
License: ISC License
My name is Raphael and I'm
The parser seems to require CRLF (instead of line ending) when RFC 9116 seems to allow for both: https://www.rfc-editor.org/rfc/rfc9116#section-2.2
Full log of the failure:
❯ cargo install sectxt
Updating crates.io index
remote: Enumerating objects: 24300, done.
remote: Counting objects: 100% (16844/16844), done.
remote: Compressing objects: 100% (553/553), done.
remote: Total 24300 (delta 16350), reused 16758 (delta 16264), pack-reused 7456
Receiving objects: 100% (24300/24300), 14.83 MiB | 9.25 MiB/s, done.
Resolving deltas: 100% (17862/17862), completed with 1530 local objects.
From https://github.com/rust-lang/crates.io-index
6463a68b6b..df6a6bcf39 -> origin/HEAD
Downloaded sectxt v0.2.2
Downloaded 1 crate (16.3 KB) in 4.01s
Installing sectxt v0.2.2
Downloaded tracing-serde v0.1.3
Downloaded anstyle-query v1.0.0
Downloaded colorchoice v1.0.0
Downloaded argh_shared v0.1.10
Downloaded rustc-demangle v0.1.23
Downloaded valuable v0.1.0
Downloaded argh_derive v0.1.10
Downloaded anstyle v1.0.0
Downloaded human-panic v1.1.4
Downloaded argh v0.1.10
Downloaded sectxtlib v0.2.2
Downloaded oxilangtag v0.1.3
Downloaded os_info v3.7.0
Downloaded anstream v0.3.0
Downloaded anstyle-parse v0.2.0
Downloaded iri-string v0.7.0
Downloaded serde_json v1.0.96
Downloaded h2 v0.3.18
Downloaded hyper v0.14.26
Downloaded syn v2.0.15
Downloaded rustix v0.37.12
Downloaded linux-raw-sys v0.3.2
Downloaded valuable-derive v0.1.0
Downloaded 23 crates (2.4 MB) in 4.08s (largest was `linux-raw-sys` at 1006.3 KB)
Compiling proc-macro2 v1.0.56
Compiling unicode-ident v1.0.8
Compiling quote v1.0.26
Compiling autocfg v1.1.0
Compiling libc v0.2.141
Compiling cfg-if v1.0.0
Compiling log v0.4.17
Compiling syn v1.0.109
Compiling memchr v2.5.0
Compiling once_cell v1.17.1
Compiling cc v1.0.79
Compiling serde_derive v1.0.160
Compiling serde v1.0.160
Compiling pin-project-lite v0.2.9
Compiling futures-core v0.3.28
Compiling pkg-config v0.3.26
Compiling bitflags v1.3.2
Compiling futures-task v0.3.28
Compiling futures-sink v0.3.28
Compiling bytes v1.4.0
Compiling tracing-core v0.1.30
Compiling itoa v1.0.6
Compiling futures-channel v0.3.28
Compiling slab v0.4.8
Compiling indexmap v1.9.3
Compiling tokio v1.27.0
Compiling hashbrown v0.12.3
Compiling futures-util v0.3.28
Compiling pin-utils v0.1.0
Compiling futures-io v0.3.28
Compiling foreign-types-shared v0.1.1
Compiling openssl v0.10.50
Compiling io-lifetimes v1.0.10
Compiling fnv v1.0.7
Compiling foreign-types v0.3.2
Compiling num-traits v0.2.15
Compiling http v0.2.9
Compiling httparse v1.8.0
Compiling tinyvec_macros v0.1.1
Compiling rustix v0.37.12
Compiling native-tls v0.2.11
Compiling tinyvec v1.6.0
Compiling num-integer v0.1.45
Compiling regex-syntax v0.6.29
Compiling linux-raw-sys v0.3.2
Compiling percent-encoding v2.2.0
Compiling syn v2.0.15
Compiling openssl-sys v0.9.85
Compiling try-lock v0.2.4
Compiling openssl-probe v0.1.5
Compiling ryu v1.0.13
Compiling want v0.3.0
Compiling form_urlencoded v1.1.0
Compiling http-body v0.4.5
Compiling backtrace v0.3.67
Compiling num_cpus v1.15.0
Compiling socket2 v0.4.9
Compiling mio v0.8.6
Compiling unicode-normalization v0.1.22
Compiling lazy_static v1.4.0
Compiling utf8parse v0.2.1
Compiling serde_json v1.0.96
Compiling gimli v0.27.2
Compiling unicode-bidi v0.3.13
Compiling tower-service v0.3.2
Compiling thiserror v1.0.40
Compiling valuable v0.1.0
Compiling winnow v0.4.1
Compiling adler v1.0.2
Compiling httpdate v1.0.2
Compiling miniz_oxide v0.6.2
Compiling regex-automata v0.1.10
Compiling idna v0.3.0
Compiling anstyle-parse v0.2.0
Compiling getrandom v0.2.9
Compiling time v0.1.45
Compiling object v0.30.3
Compiling rustc-demangle v0.1.23
Compiling iana-time-zone v0.1.56
Compiling anstyle v1.0.0
Compiling colorchoice v1.0.0
Compiling overload v0.1.1
Compiling anstyle-query v1.0.0
Compiling argh_shared v0.1.10
Compiling anyhow v1.0.70
Compiling minimal-lexical v0.2.1
Compiling nu-ansi-term v0.46.0
Compiling matchers v0.1.0
Compiling is-terminal v0.4.7
Compiling anstream v0.3.0
Compiling nom v7.1.3
Compiling chrono v0.4.24
Compiling url v2.3.1
Compiling uuid v1.3.1
Compiling addr2line v0.19.0
Compiling regex v1.7.3
Compiling sharded-slab v0.1.4
Compiling tracing-log v0.1.3
Compiling thread_local v1.1.7
Compiling encoding_rs v0.8.32
Compiling oxilangtag v0.1.3
Compiling mime v0.3.17
Compiling smallvec v1.10.0
Compiling iri-string v0.7.0
Compiling base64 v0.21.0
Compiling ipnet v2.7.2
Compiling tokio-macros v2.0.0
Compiling futures-macro v0.3.28
Compiling openssl-macros v0.1.1
Compiling thiserror-impl v1.0.40
Compiling tracing-attributes v0.1.23
Compiling valuable-derive v0.1.0
Compiling argh_derive v0.1.10
Compiling sectxtlib v0.2.2
Compiling argh v0.1.10
Compiling tracing v0.1.37
Compiling futures-executor v0.3.28
Compiling futures v0.3.28
Compiling tokio-util v0.7.7
Compiling tokio-native-tls v0.3.1
Compiling h2 v0.3.18
Compiling toml_datetime v0.6.1
Compiling serde_spanned v0.6.1
Compiling serde_urlencoded v0.7.1
Compiling os_info v3.7.0
Compiling tracing-serde v0.1.3
Compiling toml_edit v0.19.8
Compiling tracing-subscriber v0.3.16
Compiling hyper v0.14.26
Compiling toml v0.7.3
Compiling human-panic v1.1.4
Compiling hyper-tls v0.5.0
Compiling reqwest v0.11.16
Compiling sectxt v0.2.2
error[E0277]: the trait bound `valuable::Value<'_>: tracing::Value` is not satisfied
--> /home/jcgruenhage/.cargo/registry/src/github.com-1ecc6299db9ec823/sectxt-0.2.2/src/website.rs:33:25
|
33 | info!(domain = self.domain, content = txt.as_value(), status = "OK");
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `tracing::Value` is not implemented for `valuable::Value<'_>`
|
= help: the following other types implement trait `tracing::Value`:
&'a T
&'a mut T
(dyn std::error::Error + 'static)
(dyn std::error::Error + Sync + 'static)
(dyn std::error::Error + std::marker::Send + 'static)
(dyn std::error::Error + std::marker::Send + Sync + 'static)
Arguments<'a>
Box<T>
and 34 others
= note: required for the cast from `valuable::Value<'_>` to the object type `dyn tracing::Value`
= note: this error originates in the macro `$crate::valueset` which comes from the expansion of the macro `info` (in Nightly builds, run with -Z macro-backtrace for more info)
For more information about this error, try `rustc --explain E0277`.
error: could not compile `sectxt` due to previous error
error: failed to compile `sectxt v0.2.2`, intermediate artifacts can be found at `/tmp/cargo-installitrxwQ`
Hey eikendev!
Awesome work on this tool! My original goal with haksecuritytxt was to output the results in a format that works for discloseio which you can view here but honestly I probably won't get around to actually implementing that for a while.
I would love to see this tool work with that output!
Also thanks for the shoutout in the README :)
hakluke
See Section 4 for some background:
Earlier versions of this specification allowed for different (usually more liberal) syntax than is allowed in this version. Also, there have been syntactic elements used in messages on the Internet whose interpretations have never been documented. Though these syntactic forms MUST NOT be generated according to the grammar in section 3, they MUST be accepted and parsed by a conformant receiver.
The obsolete syntax leaves room for ambiguity, which nom cannot deal with. Instead, a more powerful parser would be required. Options are:
Could use pgp_cleartext crate.
If this field indicates a web URI, then it MUST begin with "https://" (...)
Waiting for tracing to stabilize its valuable support: discussion.
If a "security.txt" file is present in both locations, the one in the "/.well-known/" path MUST be used.
This is currently blocked by reqwest.
Users should also be able to provide URLs.
security.txt files can be signed, but currently we completely drop this information while parsing.
Depends on this pull request.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.