cargo-geiger
miri
cargo-geiger | miri | |
---|---|---|
30 | 121 | |
1,311 | 3,955 | |
1.1% | 2.3% | |
5.2 | 10.0 | |
13 days ago | 7 days ago | |
Rust | Rust | |
GNU General Public License v3.0 or later | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cargo-geiger
-
Was Rust Worth It?
Instead of looking at the crates themselves, you might want to check your (or others') Rust application with https://github.com/rust-secure-code/cargo-geiger to get a sense of effective prevalence. I also dispute that the presence of unsafe somewhere in the dependency tree is an issue in itself, but that's a different discussion that many more had in other sub-threads.
-
Found a language in development called Vale which claims to be the safest AOT compiled language in the World (Claims to beSafer than Rust)
There's still plenty. Run cargo geiger on any of your projects and see for yourself.
-
Question Omnibus: Dependency Fingerprinting, Unsafe Rust, and Memory Safety
On point 2, the answer is cargo geiger, and judging how much memory safety you need for a given project.
- pliron: An extensible compiler IR framework, inspired by MLIR and written in safe Rust.
-
[Discussion] What crates would you like to see?
You can use cargo-geiger or cargo-crev to check for whether people you trusted (e.g. u/jonhoo ) trust this crate.
-
How do you choose what crate you will use?
The amount of unsafe code is also a factor. cargo geiger is a handy tool for measuring it.
-
Seems legit
We have cargo-geiger that does just that.
-
Rosenpass – formally verified post-quantum WireGuard
For that, I believe you need to use cargo-geiger[0] and audit the results.
[0] - https://github.com/rust-secure-code/cargo-geiger
-
Hey Rustaceans! Got a question? Ask here (6/2023)!
cargo-geiger is a subcommand you can install which will check all the crates in your dependency graph for unsafe blocks and print out a report (which also shows if a crate has #![forbid(unsafe_code)] or not). You can then inspect those crates' sources to judge their use of unsafe for yourself. I don't think it has a "check" mode that simply errors if your dependency graph contains unsafe though, it's more about just collecting that information.
-
[CCS Proposal] Preliminary research on rewriting Monero node in Rust
wrt to memory safety, keep in mind that many rust crates use "unsafe" internally. There are tools available that can find these such as cargo-geiger. So I would suggest to avoid unsafe deps as much as possible. Since they cannot be avoided entirely, it is a good idea to keep a list of unsafe deps.
miri
-
Bytecode VMs in Surprising Places
Miri [0] is an interpreter for the mid-level intermediate representation (MIR) generated by the Rust compiler. MIR is input for more processing steps of the compiler. However miri also runs MIR directly. This means miri is a VM. Of course it's not a bytecode VM, because MIR is not a bytecode AFAIK. I still think that miri is a interesting example.
And why does miri exist?
It is a lot slower. However it can check for some undefined behavior.
[0]: https://github.com/rust-lang/miri
-
RFC: Rust Has Provenance
Provenance is a dynamic property of pointer values. The actual underlying rules that a program must follow, even when using raw pointers and `unsafe`, are written in terms of provenance. Miri (https://github.com/rust-lang/miri) represents provenance as an actual value stored alongside each pointer's address, so it can check for violations of these rules.
Lifetimes are a static approximation of provenance. They are erased after being validated by the borrow checker, and do not exist in Miri or have any impact on what transformations the optimizer may perform. In other words, the provenance rules allow a superset of what the borrow checker allows.
- Mir: Strongly typed IR to implement fast and lightweight interpreters and JITs
-
Running rustc in a browser
There has been discussion of doing this with MIRI, which would be easier than all of rustc.
-
Piecemeal dropping of struct members causes UB? (Miri)
This issue has been fixed: https://github.com/rust-lang/miri/issues/2964
- Erroneous UB Error with Miri?
-
I've incidentally created one of the fastest bounded MPSC queue
Actually, I've done more advanced tests with MIRI (see https://github.com/rust-lang/miri/issues/2920 for example) which allowed me to fix some issues. I've also made the code compatible with loom, but I didn't found the time yet to write and execute loom tests. That's on the TODO-list, and I need to track it with an issue too.
-
Interested in "secure programming languages", both theory and practice but mostly practice, where do I start?
He is one of the big brains behind Miri, which is a interpreter that runs on the MIR (compiler representation between human code and asm/machine code) and detects undefined behavior. Super useful tool for language safety, pretty interesting on its own.
-
Formal verification for unsafe code?
I would also run your tests in Miri (https://github.com/rust-lang/miri) to try to cover more bases.
-
Ouroboros is also unsound
You can run miri and it will tell you if the given run triggered any undefined behavior. It will not analyze it for every possible use of the code, but checking for the presence of this specific issue using it should be fairly simple.
What are some alternatives?
bacon - background rust code check
cons-list - Singly-linked list implementation in Rust
ziglings - Learn the Zig programming language by fixing tiny broken programs.
sanitizers - AddressSanitizer, ThreadSanitizer, MemorySanitizer
nomicon - The Dark Arts of Advanced and Unsafe Rust Programming
rust - Empowering everyone to build reliable and efficient software.
mold - Mold: A Modern Linker 🦠
Rust-Full-Stack - Rust projects here are easy to use. There are blog posts for them also.
orz - a high performance, general purpose data compressor written in the crab-lang
rfcs - RFCs for changes to Rust
dlfile - For dl the file