xwin VS cargo-deny

There's tooling that mostly avoids this. https://github.com/Jake-Shadle/xwin

This is a utility that fixes a lot of the cross-compiling issues for windows by giving you a portable, unfucked naming, and not-massive SDK. It's the same SDK you get when you install MSVC but it's only a few hundred megs and the names are consistent even with all of Windows' fucked up tooling.

The only caveat is you need to provide your own compiler, in this case clang is often the best option.

cargo-xwinbuild is a thin wrapper of xwin provides a Cargo subcommand xwinbuild to make cross compiling to Windows MSVC target just work.

This situation bugs me a lot, and I remembered a blog post about the xwin which makes cross compiling Windows binaries from Linux quite easy, but it requires a lot of manual setup. While using Docker containers make it easier, it's also slower.

I will do you one better. When I do windows development, I work within WSL and use the cross-compiler toolchain to generate windows binaries. I have found "Xwin" to be very useful for this: https://github.com/Jake-Shadle/xwin

I've just pushed a 0.1.1 release that fixes this issue, unsure why the windows crate decided to use screaming case in their link names but I'm sure they're not the only ones.

Tip: You can check the licenses of all your dependencies (recursively) using cargo-deny: https://github.com/EmbarkStudios/cargo-deny

cargo-deny

cargo-deny can help block specified versions of a crate and even has some advisory features that can probably used to block crate with reported vulnerabilities

cargo deny for fetching crates only from trusted sources, blacklisting crates, etc.

Use cargo audit or cargo deny to check the crates in your Cargo.lock to ensure they don't contain any vulnerabilities.

> Explain the crate scanner thing?

I assume a reference to tools that help manage potential issues around dependencies, e.g.:

* https://github.com/rustsec/rustsec/tree/main/cargo-audit

* https://github.com/EmbarkStudios/cargo-deny

"[cargo-audit] Audit Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database."

"cargo-deny is a cargo plugin that lets you lint your project's dependency graph to ensure all your dependencies conform to your expectations and requirements." e.g. license, security advisories, source.

cargo-deny does license and security advisory checking, and cargo-geiger does unsafe checking.

cargo-deny

OpenSSL has been banned in our project for a variety of reasons via cargo-deny for around a year and half, it was actually one of the reasons we created it in the first place.