cargo-deny
cargo-supply-chain
| cargo-deny | cargo-supply-chain | |
|---|---|---|
| 15 | 20 | |
| 1,554 | 311 | |
| 1.7% | 1.3% | |
| 8.8 | 4.9 | |
| 5 days ago | about 2 months ago | |
| Rust | Rust | |
| Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cargo-deny
-
Please add licenses to your projects, rust DS emulator Dust now dead.
Tip: You can check the licenses of all your dependencies (recursively) using cargo-deny: https://github.com/EmbarkStudios/cargo-deny
- Cargo-deny: a cargo plugin for linting Rust project dependencies
-
What are some useful tools for Rust?
cargo-deny
-
Can versions of a crate be blocked / be made unusable / be made not downloadable?
cargo-deny can help block specified versions of a crate and even has some advisory features that can probably used to block crate with reported vulnerabilities
-
Best way to protect a project from supply chain attacks?
cargo deny for fetching crates only from trusted sources, blacklisting crates, etc.
-
NPM malware and what it could imply for Cargo
Use cargo audit or cargo deny to check the crates in your Cargo.lock to ensure they don't contain any vulnerabilities.
-
This Year in Embedded Rust: 2021 edition
> Explain the crate scanner thing?
I assume a reference to tools that help manage potential issues around dependencies, e.g.:
* https://github.com/rustsec/rustsec/tree/main/cargo-audit
* https://github.com/EmbarkStudios/cargo-deny
"[cargo-audit] Audit Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database."
"cargo-deny is a cargo plugin that lets you lint your project's dependency graph to ensure all your dependencies conform to your expectations and requirements." e.g. license, security advisories, source.
-
Score card for dependencies in a project
cargo-deny does license and security advisory checking, and cargo-geiger does unsafe checking.
-
How can we make sure this doesn't happen with Crates.io?
cargo-deny
-
Blog post: Cross compiling Rust Windows binaries from Linux
OpenSSL has been banned in our project for a variety of reasons via cargo-deny for around a year and half, it was actually one of the reasons we created it in the first place.
cargo-supply-chain
-
Release of Structsy 0.5
Great news! Sounds like a good way to add caching to cargo supply-chain. There's a lot of small chunks of data we want to persist.
-
greater supply chain attack risk due to large dependency trees?
Shameless plug: https://github.com/rust-secure-code/cargo-supply-chain shows the supply chain attack surface for your Rust project.
-
Announcement: xflags 3.0.0
bpaf: https://github.com/rust-secure-code/cargo-supply-chain/blob/29bfcb256001cdef46830544b554d33c56602030/src/cli.rs
-
Yet another command line argument parser: bpaf 0.5.2
I'm very happy with it for cargo supply-chain. I appreciate that it has no unsafe code, no sprawling dependency tree, and supports OsStr in addition to just &str.
-
Best way to protect a project from supply chain attacks?
cargo supply-chain to see your attack surface for supply chain attacks
- Cargo-supply-chain: Rust author, contributor and publisher data for dep. crates
-
Comparing Rust supply chain safety tools
See also: cargo supply-chain
-
Yet another command line argument parser: bpaf 0.4.0
I've used bpaf for cargo supply-chain and I'm very happy with it.
-
Fundamental - finding out who you can fund in dependency tree
https://github.com/rust-secure-code/cargo-supply-chain can also help here.
-
Announcing `cargo supply-chain` v0.3: revamped CLI, separate JSON schema
cargo supply-chain list the publishers of all crates in your dependency graph. With it you can:
What are some alternatives?
cargo-about - 📜 Cargo plugin to generate list of all licenses for a crate 🦀
cap-std - Capability-oriented version of the Rust standard library
advisory-db - Security advisory database for Rust crates published through crates.io
paru - Feature packed AUR helper
xwin - A utility for downloading and packaging the Microsoft CRT headers and libraries, and Windows SDK headers and libraries needed for compiling and linking programs targeting Windows.
cargo-crev - A cryptographically verifiable code review system for the cargo (Rust) package manager.
crates.io-index - Registry index for crates.io
cargo-auditable - Make production Rust binaries auditable
static_init
eve-rs - A simple, intuitive, express-like HTTP library
nextest - A next-generation test runner for Rust.
cargo-msrv - 🦀 Find the minimum supported Rust version (MSRV) for your project