creusot
miri
creusot | miri | |
---|---|---|
15 | 122 | |
868 | 4,003 | |
- | 3.5% | |
9.6 | 10.0 | |
3 months ago | 7 days ago | |
Rust | Rust | |
GNU Lesser General Public License v3.0 only | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
creusot
-
Conditioonal Compilation across Crates?
However, it seems that C is not "notified" whether --cfg thing is set, only the main crate being built is. Regardless of this flag, the dummy macro is always chosen. Am I doing something wrong? It should work; the Creusot project is doing something similar.
-
Kani 0.29.0 has been released!
I believe https://github.com/xldenis/creusot is more similar in that it also uses proofs to prove rust code correct.
-
Prop v0.42 released! Don't panic! The answer is... support for dependent types :)
Wow that sounds really cool! I'm not an expert but does that mean that one day you could implement dependend types or refinement types in Rust as a crate ? I currently only know of tools like: Flux Creusot Kani Prusti
-
Linus Torvalds: Rust will go into Linux 6.1
Easy reasoning does not end on memory safety. For example, deductive verification of Rust code is possible exactly because there's no reference aliasing in safe Rust
-
A personal list of Rust grievances
> No support for using something like separation logic within Rust itself to verify that unsafe code upholds the invariants that the safe language expects.
I think this is something we might see in the future. There are a lot of formal methods people who are interested in rust. Creusot in particular is pretty close to doing this - at least for simpler invariants
https://github.com/xldenis/creusot
-
Whiley, a language with statically checked pre and post conditions, releases its 0.6.1 version and portions implemented in Rust
Seems similar in principle to cruesot except as another language instead of as a layer on-top of rust.
-
What it feels like when Rust saves your bacon
You often encounter this entire thread of rhetoric when someone wants to put a diversion into the central argument, yeah but it doesn't ____.
But Rust does do that, match exhaustiveness, forcing the handling of errors and the type system enables things like CreuSAT [1] using creusot [2]
[1] https://news.ycombinator.com/item?id=31780128
[2] https://github.com/xldenis/creusot
> Creusot works by translating Rust code to WhyML, the verification and specification language of Why3. Users can then leverage the full power of Why3 to (semi)-automatically discharge the verification conditions!
Units of Measure, https://github.com/iliekturtles/uom
The base properties of the language enable things that can never be done in C++.
- Creusot: Deductive Verification of Rust
-
What Is Rust's Unsafe?
> I’ve been working on a tool: https://github.com/xldenis/creusot to put this into practice
Note that there are other tools trying to deal with formal statements about Rust code. AIUI, Rust developers are working on forming a proper working group for pursuing these issues. We might get a RFC-standardized way of expressing formal/logical conditions about Rust code, which would be a meaningful first step towards supporting proof-carrying code within Rust.
-
AdaCore and Ferrous Systems Joining Forces to Support Rust
This is exciting! I've met with people from AdaCore and Ferrous systems (individually) several times and they're all serious, competent and motivated.
I'm curious what kinds of software they want to (eventually) verify, my PhD thesis is developing a verification tool for Rust (https://github.com/xldenis/creusot) and I'm always on the look out for case studies to push me forward.
The road to formally verified Rust is still long but in my unbiased opinion looking quite bright, especially compared to other languages like C.
miri
-
Rust: Box Is a Unique Type
>While we are many missing language features away from this being the case, the noalias case is also magic descended upon box itself, with no user code ever having access to it.
I'm not sure why the author thinks there's magic behind Box. Box is not a special case of `noalias`. Run this snippet with miri and you'll see the same issue: https://play.rust-lang.org/?version=stable&mode=debug&editio...
`Box` _does_ have an expectation that its inner pointer is not aliased to another Box (even if used for readonly operations). See: https://github.com/rust-lang/miri/issues/1800#issuecomment-8...)
-
Bytecode VMs in Surprising Places
Miri [0] is an interpreter for the mid-level intermediate representation (MIR) generated by the Rust compiler. MIR is input for more processing steps of the compiler. However miri also runs MIR directly. This means miri is a VM. Of course it's not a bytecode VM, because MIR is not a bytecode AFAIK. I still think that miri is a interesting example.
And why does miri exist?
It is a lot slower. However it can check for some undefined behavior.
[0]: https://github.com/rust-lang/miri
-
RFC: Rust Has Provenance
Provenance is a dynamic property of pointer values. The actual underlying rules that a program must follow, even when using raw pointers and `unsafe`, are written in terms of provenance. Miri (https://github.com/rust-lang/miri) represents provenance as an actual value stored alongside each pointer's address, so it can check for violations of these rules.
Lifetimes are a static approximation of provenance. They are erased after being validated by the borrow checker, and do not exist in Miri or have any impact on what transformations the optimizer may perform. In other words, the provenance rules allow a superset of what the borrow checker allows.
- Mir: Strongly typed IR to implement fast and lightweight interpreters and JITs
-
Running rustc in a browser
There has been discussion of doing this with MIRI, which would be easier than all of rustc.
-
Piecemeal dropping of struct members causes UB? (Miri)
This issue has been fixed: https://github.com/rust-lang/miri/issues/2964
- Erroneous UB Error with Miri?
-
I've incidentally created one of the fastest bounded MPSC queue
Actually, I've done more advanced tests with MIRI (see https://github.com/rust-lang/miri/issues/2920 for example) which allowed me to fix some issues. I've also made the code compatible with loom, but I didn't found the time yet to write and execute loom tests. That's on the TODO-list, and I need to track it with an issue too.
-
Interested in "secure programming languages", both theory and practice but mostly practice, where do I start?
He is one of the big brains behind Miri, which is a interpreter that runs on the MIR (compiler representation between human code and asm/machine code) and detects undefined behavior. Super useful tool for language safety, pretty interesting on its own.
-
Formal verification for unsafe code?
I would also run your tests in Miri (https://github.com/rust-lang/miri) to try to cover more bases.
What are some alternatives?
misra-rust - An investigation into what adhering to each MISRA-C rule looks like in Rust. The intention is to decipher how much we "get for free" from the Rust compiler.
cons-list - Singly-linked list implementation in Rust
l4v - seL4 specification and proofs
sanitizers - AddressSanitizer, ThreadSanitizer, MemorySanitizer
Daikon - Dynamic detection of likely invariants
rust - Empowering everyone to build reliable and efficient software.
agda-stdlib - The Agda standard library
Rust-Full-Stack - Rust projects here are easy to use. There are blog posts for them also.
hacspec - Please see https://github.com/hacspec/hax
rfcs - RFCs for changes to Rust
CreuSAT - CreuSAT - A formally verified SAT solver written in Rust and verified with Creusot.
nomicon - The Dark Arts of Advanced and Unsafe Rust Programming