cargo-sweep VS cargo-deny

You can use cargo sweep or kondo to clean up unused files.

cargo-sweep

[1]: https://github.com/holmgr/cargo-sweep

I use https://github.com/holmgr/cargo-sweep which can keep files from the current compiler version, but delete files from earlier compilers that won't ever be used again.

How is this different from https://github.com/holmgr/cargo-sweep ?

I like https://github.com/holmgr/cargo-sweep to keep the size of /target from unbounded growth without fully losing the useful portion of the cache. It's the same outcome as Cargo clean after a reboot but I recently also started using a ramdisk with CARGO_TARGET_DIR. Much easier to do on Linux.

cargo-sweep can do this kind of garbage collection along a few axes - rustc version, file age, was or wasn't used during recent build. Works great on Linux. I've not gotten it working reliably for -s/-f on MacOS+APFS, but for the CI use case it should be a nice improvement.

holmgr is a god and cargo-sweep is a godsend

Tip: You can check the licenses of all your dependencies (recursively) using cargo-deny: https://github.com/EmbarkStudios/cargo-deny

cargo-deny

cargo-deny can help block specified versions of a crate and even has some advisory features that can probably used to block crate with reported vulnerabilities

cargo deny for fetching crates only from trusted sources, blacklisting crates, etc.

Use cargo audit or cargo deny to check the crates in your Cargo.lock to ensure they don't contain any vulnerabilities.

> Explain the crate scanner thing?

I assume a reference to tools that help manage potential issues around dependencies, e.g.:

* https://github.com/rustsec/rustsec/tree/main/cargo-audit

* https://github.com/EmbarkStudios/cargo-deny

"[cargo-audit] Audit Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database."

"cargo-deny is a cargo plugin that lets you lint your project's dependency graph to ensure all your dependencies conform to your expectations and requirements." e.g. license, security advisories, source.

cargo-deny does license and security advisory checking, and cargo-geiger does unsafe checking.

cargo-deny

OpenSSL has been banned in our project for a variety of reasons via cargo-deny for around a year and half, it was actually one of the reasons we created it in the first place.