Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switchover official RustSec frontend #300

Closed
wants to merge 3 commits into from
Closed

Switchover official RustSec frontend #300

wants to merge 3 commits into from

Conversation

Jake-Shadle
Copy link
Member

This PR is mainly just so interested parties can review the docs/official-fronted-announcement.md before I post it on users.rust-lang.org and possibly link from Reddit as well.

Ping @tarcieri, feel free to add a review as well!

Bonus:
Add link the cargo-deny Discord channel

Resolves: #194

@Jake-Shadle Jake-Shadle requested review from repi and arirawr October 21, 2020 16:30
@repi
Copy link
Contributor

repi commented Oct 21, 2020

Cool!

@XAMPPRocky may be interested in checking through this also

@tarcieri
Copy link

tarcieri commented Oct 21, 2020

@Jake-Shadle so I've somewhat backpedaled on this idea, primarily because we'd like to integrate call graph analysis into cargo-audit (potentially moving it into the rustsec crate in a way that cargo-deny could optionally also use it) and think that will be important in the future to prevent alert fatigue as the vulnerability database grows larger. In surveying feedback from users of RustSec-like vulnerability databases including ones in other languages, this seems to be the most common reason people abandon using them.

I'd be happy to help add references to cargo-deny on the RustSec web site as a "batteries included" alternative, but I don't think it makes sense to designate cargo-deny as the "official" RustSec frontend.

As it were, the prerequisites for this problem we've been waiting on (namely a way to consume Siderophile as a library) have just landed, so we hope to start making progress on call graph analysis soon.

If we do manage to get call graph analysis into the rustsec crate, and it's integrated into cargo-deny, at that time I think we could make this sort of announcement. Sorry to shift the goalposts, but I think it's important.

@Jake-Shadle
Copy link
Member Author

@tarcieri Ahh ok, that makes sense, I'll just close this and the original issue then, we can maybe revisit this in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Making cargo-deny the official RustSec frontend?
3 participants