cargo-supply-chain
cap-std
cargo-supply-chain | cap-std | |
---|---|---|
20 | 12 | |
311 | 622 | |
1.3% | 0.8% | |
4.9 | 6.6 | |
about 1 month ago | about 1 month ago | |
Rust | Rust | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cargo-supply-chain
-
Release of Structsy 0.5
Great news! Sounds like a good way to add caching to cargo supply-chain. There's a lot of small chunks of data we want to persist.
-
greater supply chain attack risk due to large dependency trees?
Shameless plug: https://github.com/rust-secure-code/cargo-supply-chain shows the supply chain attack surface for your Rust project.
-
Announcement: xflags 3.0.0
bpaf: https://github.com/rust-secure-code/cargo-supply-chain/blob/29bfcb256001cdef46830544b554d33c56602030/src/cli.rs
-
Yet another command line argument parser: bpaf 0.5.2
I'm very happy with it for cargo supply-chain. I appreciate that it has no unsafe code, no sprawling dependency tree, and supports OsStr in addition to just &str.
-
Best way to protect a project from supply chain attacks?
cargo supply-chain to see your attack surface for supply chain attacks
- Cargo-supply-chain: Rust author, contributor and publisher data for dep. crates
-
Comparing Rust supply chain safety tools
See also: cargo supply-chain
-
Yet another command line argument parser: bpaf 0.4.0
I've used bpaf for cargo supply-chain and I'm very happy with it.
-
Fundamental - finding out who you can fund in dependency tree
https://github.com/rust-secure-code/cargo-supply-chain can also help here.
-
Announcing `cargo supply-chain` v0.3: revamped CLI, separate JSON schema
cargo supply-chain list the publishers of all crates in your dependency graph. With it you can:
cap-std
-
Rust Library Team Aspirations | Inside Rust Blog
I believe you mean capability based, like cap-std.
-
A Performance Evaluation on Rust Asynchronous Frameworks
There might be another reason to prefer async-std right now: the Bytecode Alliance is working on a version of std with support for capability-based security (called cap-std: https://github.com/bytecodealliance/cap-std ), and their async version is based on async-std (called cap-async-std: https://github.com/bytecodealliance/cap-std/tree/main/cap-async-std ). Given the clout that the Bytecode Alliance has, async-std might end up carving a niche out in the Wasm domain.
-
Backdooring Rust crates for fun and profit
Would love to see something like this implemented around creating a Process in cap-std ( https://github.com/bytecodealliance/cap-std/issues/190 )
-
Scripting Languages of the Future
I think it's not discussed enough how things like language features shape how library APIs are formed. People usually seem to only consider the question "how would I use this feature?" and not "how would the standard library look like with this feature?", which is surprising given how much builtin libraries affect the pleasantness of a language.
One of the things I'm excited to see is the cap-std project for Rust [0] given what Pony [1] has demonstrated is possible with capabilities. I'm also hoping that languages like Koka [2] and OCaml [3] will demonstrate interesting use cases for algebraic effects.
[0] https://github.com/bytecodealliance/cap-std
[1] https://www.ponylang.io/discover
[2] https://koka-lang.github.io
[3] https://github.com/ocaml-multicore/effects-examples
- Is using crates more safe than using npm?
-
Why WebAssembly is innovative even outside the browser
I'm not sure you could hack the control flow when running bytecode on the JVM, but I strongly doubt that. (The JVM is "high-level" as pointed out previously and doesn't execute ASM like code. So there is no of the attack surface you have to care on the ASM level).
And capabilities are anyway something that belongs into the OS — and than programs need to be written accordingly. The whole point of the capability-security model is that you can't add it after the fact. That's why UNIX isn't, and never will be, a capability secure OS.
But "sanboxing" some process running on a VM is completely independent of that!
WASM won't get you anything beyond a "simple sanbox" ootb. Exactly the same as you have in the other major VM runtimes.
If you want capability-secure Rust, there is much more to that. You have to change a lot of code, and use an alternative std. lib¹. Of course you can't than use any code (or OS functionality) when it isn't also capability-secure. Otherwise the model breaks.
To be capability-secure you have actually to rewrite the world…
¹ https://github.com/bytecodealliance/cap-std
-
Security review of "please", a sudo replacement written in Rust
The type system could definitely help. There's all sorts of things we can do. One really cool project is https://github.com/bytecodealliance/cap-std
- Preparing rustls for wider adoption
- cap-std: Capability-oriented version of the Rust standard library
-
First class I/O
On the topic of unsafe being used to describe raw file descriptors, on one hand, there is a sense in which file descriptors are pointers, into another memory. They can leak, dangle, alias, or be forged, in exactly the same way. On the other, there is an open issue about this.
What are some alternatives?
paru - Feature packed AUR helper
godot-wasm-engine
cargo-crev - A cryptographically verifiable code review system for the cargo (Rust) package manager.
watt - Runtime for executing procedural macros as WebAssembly
cargo-auditable - Make production Rust binaries auditable
cargo2nix - Granular builds of Rust projects for Nix
eve-rs - A simple, intuitive, express-like HTTP library
rusty-wacc-viewer
cargo-msrv - 🦀 Find the minimum supported Rust version (MSRV) for your project
effects-examples - Examples to illustrate the use of algebraic effects in Multicore OCaml
crates.io-index - Registry index for crates.io
bsnes-plus-wasm - debug-oriented fork of bsnes, with added wasm runtime for scripting