rust-secure-code / projects Goto Github PK

RustSec is no longer the only way to get Rust vulnerability disclosures.

https://github.com/advisories?query=type%3Areviewed+ecosystem%3Arust

https://osv.dev/list?ecosystem=crates.io&q=

Hi, the list is fantastic. I found that the link(https://github.com/RustCrypto/utils/tree/master/ctgrind) to ctgrind is no longer valid. What is the current status of this project? Or are there any other options?

"rustsec" is the name of the vulnerability database. I think it's a bit confusing to have projects related to the WG also branded as "rustsec".

Perhaps just rename this repo to "projects" so it's rust-secure-code/projects?

I no longer wish to maintain 4 crates which have accumulated dependents. Instead of transferring ownership over the name to the first person who shows interest in a project, should I publish a breaking version change which erases all functionality and announces the crate is archived, then suggest migrating to or creating a new fork. Listing known alternatives if they exist.

What do you think?

Alternatively I would be happy to transfer the crates to any member of this organization with implicit trust.

The crates in question have 11, 1, 18, 1, dependents respectively. The nature of alloc_counter and criterion-cycles-per-byte tend towards security contexts, notably cryptography.

https://crates.io/crates/alloc_counter/reverse_dependencies
https://crates.io/crates/alloc_counter_macro/reverse_dependencies
https://crates.io/crates/criterion-cycles-per-byte/reverse_dependencies
https://crates.io/crates/wrapped_enum/reverse_dependencies

Mozilla's Cargo Vet probably belongs in your list somewhere.
https://github.com/mozilla/cargo-vet
https://mozilla.github.io/cargo-vet/

Their FAQ draws a comparison to cargo crev, so maybe place it next to that.

Since cargo-deny also provides vulnerability checking (I think it uses the same underlying code as cargo-audit) it would be nice to mention it here. (Of course it does some more things which might also be mentioned somehow.) It seems like a nice unified solution.