security-products VS Cargo

Gitlab uses OSS analyzers for vulnerability detection. You will need to see what predefined rules are set up for the analyzers that were ran for the code in question. More than likely, these predefined rules will not detect everything. A POC will allow you to understand the limits of the provided rulesets, and you will need to customize your own rules for gaps that you find. You can find a list of analyzers here https://gitlab.com/gitlab-org/security-products/analyzers.

>> The only commands that will change the go.mod (and therefore the build) are go get and go mod tidy. These commands are not expected to be run automatically or in CI, so changes to dependency trees must be made deliberately and have the opportunity to go through code review.

GO doesn't do jack shit to mitigate supply chain attacks. Version pinning with checksum and that is it. But what could they do? Solve supply chain attacks as a language feature? That doesn't even make sense.

Application developers using Go must prevent supply chain attacks against their applications. So go get some SAST for your pipeline.

Sure there is truth in saying: always verify your dependencies (and their dependencies) yourself with a code review on every update. But lets talk about collaborative vulnerability management instead. (yes there could be other attestations, but one thing at a time).

Let's say repositories that publishes go modules should also publish a curated list of known vulnerabilities (including known supply chain attacks) for the modules they publish. This curation is work: reports must be verified before being included in the list and they must be verified quickly. This work scales with the number of packages published. And worse, modules could be published in more than one repository, module publishing repository can be different from source code repositories, and lists of vulnerabilities can exist independent from these repository - so reports should be synced between different list providers. Different implementations and lack of common standards make this a hard problem. And implicit trust for bulk imports could open the door for takedown attacks.

There is an argument that vulnerability listing should be split from source and module publishing: each focusing on their core responsibility. For supply chain attacks especially this split in responsibilities also makes it harder for an attacker to both attack suppliers and suppress reports. But for all other issues it increase distance as reports must travel upstream. And it creates perverse incentives, like trying to keep reports exclusive to paying customers.

To pile on the insanity: reports can be wrong. And there are unfixed CVEs that are many years old (well ok maybe not for go... yet). Downstream there are "mitigated" and "wont-fix" classifications for reports about dependencies and many SAST tooling can't parse that for transitive dependencies.

Really, supply chain attacks are the easy case in vulnerability management, because they are so obviously a "must-fix" when detected. (and to please the never update crowd: for a downstream project "fix" can mean not updating a dependency into an attacked version)

Long story short: go get some SAST in your pipelines to defend against supply chain attacks. Like GitLabs Gemnasium ( https://gitlab.com/gitlab-org/security-products/gemnasium-db... ) or GitHubs Dependabot ( https://github.com/advisories?query=type%3Areviewed+ecosyste... ) among many, many others. (not recommendations, just examples!)

This helps you sort out supply chain attacks that other people have already found, before you update into them. (Collaboration!) is useful. Sure you are still left with reading the source changes of any dependency update, because who knows, you may be the first one to spot one, but hey, good for you.

What's with the weird terms to/for the database?

GitLab documentation says nothing about Auth0 and I'm almost inclined to go in and edit Gitlab's code but that feels like it defeats the point of their plan which isn't cheap and I'd rather not have to maintain a workaround fix. Our GitLab contact hasn't been able to give a solid answer for this either.

Interesting thought from https://twitter.com/d_scho/status/1419752750351540231

> Isn‘t dependabot doing the same, basically?

with a response in the thread at https://twitter.com/solidnerd/status/1420307219745230850

> Dependabot / renovate only checking for version updates of your programm deps. Package Hunter analyze a program's deps for unexpected behavior (mal code) by installing the dependencies in a sandbox env and monitors system calls executed during the installation.

Package Hunter requires Falco, Docker and NodeJS to run, following the instructions at https://gitlab.com/gitlab-org/security-products/package-hunt... - give it a try :)

Installing Trunk happens through Cargo. Remember, Cargo is more than a package manager, it also supports sub-commands.

Dependency Management in Other Languages: We've discussed Python and Node.js in this article, but dependency management is a universal concept in programming. Exploring how you handle dependencies in other languages like Java, C#, or Rust could be beneficial. (I think Rust's cargo is an excellent example of a package manager.)

Nice hack! Would it have been possible back then to use cargo to pull in some dependencies?

The clean solution of cargo script is here: https://github.com/rust-lang/cargo/issues/12207

Yes, I am sure this is going to be a part of Rust 1.77.0 and it will release on 21st March. I say that because of the tag in the PR (https://github.com/rust-lang/cargo/pull/13257#event-11505613...).

I'm no expert on Rust compiler development, but my understanding is that all code that is merged into master is available on nightly. If they're not behind a feature flag (this one isn't), they'll be available in a full release within 12 weeks of being merged. Larger features that need a lot more testing remain behind feature flags. Once they are merged into master, they remain on nightly until they're sufficiently tested. The multi-threaded frontend (https://blog.rust-lang.org/2023/11/09/parallel-rustc.html) is an example of such a feature. It'll remain nightly only for several months.

Again, I'm not an expert. This is based on what I've observed of Rust development.

The author provides very surface-level criticism of two Rust tools, but they don't look into why those choices were made.

With about five minutes of my time, I found out:

wrap_comments was introduced in 2019 [0]. There are bugs in the implementation (it breaks Markdown tables), so the option hasn't been marked as stable. Progress on the issue has been spotty.

--no-merge-sources is not trivial to re-implement [1]. The author has already explained why the flag no longer works -- Cargo integrated the command, but not all of the flags. This commit [2] explains why this functionality was removed in the first place.

Rust is open source, so the author of this blog post could improve the state of the software they care about by championing these issues. The --no-merge-sources error message even encourages you to open an issue, presumably so that the authors of Cargo can gauge the importance of certain flags/features.

You could even do something much simpler, like adding a comment to the related issues mentioning that you ran into these rough edges and that it made your life a little worse, or with a workaround that you found.

Alternatively, you can continue to write about how much free software sucks.

[0]: https://github.com/rust-lang/rustfmt/issues/3347

[1]: https://github.com/rust-lang/cargo/pull/10344

[2]: https://github.com/rust-lang/cargo/commit/3842d8e6f20067f716...

You try to use it as a part of multi-language project, with an external build tool to tie it all together, and you discover that --out-dir flag is still not stabilized over some future compatibility concerns.

To create a new application we'll use cargo (a build tool and also a package manager for Rust. It is used for scaffolding new library/binary projects). So in your projects folder, you can run this command in your terminal:

> ...but at the end of the day Cargo is the reason that Rust is popular.

FWIW, maybe that's true for you, but there are numerous other advantages to the language for which many people choose to use Rust--some even "despite" Cargo: you see Google having had to put in way way WAY too much work to get Bazel working for Rust :/--that it honestly feels a bit like belittling an extremely important language to make this claim so flippantly.

> You can set a default build target for a Cargo project with two lines of configuration, no nightly features necessary...

This doesn't work as, as soon as you start setting target-specific options, it infects the host build, as they incorrectly modelled the problem as some kind of map from targets to flags. If you don't believe me, on your Linux computer, try cross-compile something complicated that will runs on a "least common denominator" Linux distribution, such as CentOS 7.

> Can you clarify what this is referring to?

Sure. I've Googled rust cargo target host bugs for you (which, FWIW, finds a number of bugs I've filed or have talked about, but it isn't as if I have a list anywhere). Note that one of these bugs is "closed", but I still provide them for context as a patch might have been merged but (as you'll find out if you read through all of these) it isn't stable.

https://github.com/rust-lang/cargo/issues/8147

https://github.com/rust-lang/cargo/issues/3349

https://github.com/rust-lang/cargo/pull/9322

https://github.com/rust-lang/cargo/issues/9453

https://github.com/rust-lang/cargo/pull/9753

The result of this work being left incomplete is that increasingly large numbers of "serious" projects--things I'd expect people in packaging land to have heard of, such as BuildRoot--are being forced to set the ridiculous environment variable __CARGO_TEST_CHANNEL_OVERRIDE_DO_NOT_USE_THIS="nightly" in order to get access to a flag that makes Cargo sort of work.

(And yet, I often see people surprised at how long it is taking for various of the more important clients to fully get into using Rust, as the safety issues are so severe from continuing to use C/C++: as you made the contention that you believe the reason why people use Rust is Cargo, I will say the opposite: the reason why we don't see more Rust is also Cargo.)