cargo-crev

Part of the rust dependency issue is that the compiler only multithreads at the crate level currently (slowly being improved on nightly, but there's still some bugs before they can roll out the parallel compiler), so most libraries split themselves up into a ton of small crates because otherwise they just take too long to compile. edit: Also, `cargo-vet` is useful for distributed auditing of crates. There's also `cargo-crev`, but afaik it doesn't have buy in from the megacorps like cargo-vet and last I checked didn't have as many/as consistent reviews. https://github.com/mozilla/cargo-vet https://github.com/crev-dev/cargo-crev

Things like cargo-crev [0] or cargo vet [1] aim to tackle a subset of that problem. There’s also alternate implementations of crev [2] for other languages, but I’m not sure about the maturity of those integrations and their ecosystems. [0] https://github.com/crev-dev/cargo-crev [1] https://mozilla.github.io/cargo-vet/ [2] https://github.com/crev-dev/crev/

Thanks! The kind of work I do is about making an existing operating system issue reproducible packages, to the point that you can install a system with reproducible-only packages. This assumes "trusted source code and compiler", but no more tampering by the build server, which is already quite the improvement from what we have right now. To solve the need for trusted compilers (aka bootstrap from binary seeds) you're probably interested in https://bootstrappable.org/ and https://codeberg.org/stagex/stagex. To solve the need for trusted source code there isn't really any solution besides "have people publicly document the source code they have read", like https://github.com/crev-dev/cargo-crev does. Often people ask "how do I know whose reviews to trust", but in reality there's a scarcity of reviews even if you're willing to trust literall

It unfortunately doesn't help in cases like this. Reproducible Builds gives you a trusted path from source to binary, but it doesn't help with backdoors in the source code/build instructions. For that we'd need some sort of source code reviewing effort like https://github.com/crev-dev/cargo-crev implements. I've started whatsrc.org to keep track of the source code inputs we're putting into our computers (that would benefit from reviews), but the conclusion is also somewhat "it's too much".

End-to-end it would require something like a web-of-trust or similar. There is little benefit in knowing that your package was definitely built by GitHub Actions definitely from the code that definitely came from the fingers of the random guy who maintains that particular tool. Unless you have some trust relationship with the author, or with someone that audited the code, the whole cryptographically-authenticated chain hangs from nothing. Tools like Crev did a lot of work in that area but it never really took off, people don't want to think about trust: https://github.com/crev-dev/cargo-crev

the idea is valid, but current LLMs suck, as the sibling comment says, they hallucinate too much, etc. that doesn't mean they won't improve enough in the next decade (especially coupled with clever loops, where the generated code is checked, end-to-end tested, static analyzed) but this also shows what's really missing from these old projects, infrastructure, QA, CI, modern tools, etc. and adding these requires humans in the loops, and every change needs to be checked, verified, etc. and it's a hard task for a loose community of volunteers. even the super fancy Rust community kind of shrugged and let crev die silently https://github.com/crev-dev/cargo-crev

instead the downloaded malicious code runs in prod. maybe, if you are lucky, it does something strange in CI and you can catch it. the only real solution is a reputation system (like https://github.com/crev-dev/cargo-crev ), which of course is unfortunately barely used

It's a decent starting point, but it's an assumption that they're not collecting data (because it is discoverable if it's written in the code); however is not always true. You should check the source code for every project you're using as much as possible to really ensure that there isn't anything obviously nefarious like telemetry included, because in some cases it's still there. See Sunxi's Linux SBC backdoors on git for one of many examples of undocumented insecure or privacy-breaking code. In other cases it may be more documented, such as Golangs baked-in telemetry. There should be better ways to check these problems. The best I have found so far is Crev https://github.com/crev-dev/crev/. It's most used implementation is Cargo-crev https://github.com/crev-dev/cargo-crev, but hopefully it will become more required to use these types

The main problem the author is talking about is actually about version updates, which in Maven as well as crates.io is up to each lib's author, and is not curated in any way. There's no technical solution to that, really. Do you think Nexus Firewall can pick up every exploit, or even most? How confident of that are you, and what data do you have to back that up? I don't have any myself, but would not be surprised at all if "hackers" can easily work around their scanning. However, I don't have a better approach than using scanning tools like Nexus, or as the author proposes, use a curated library repository like Debian is doing (which hopefully gets enough eyeballs to remain secure) or the https://github.com/crev-dev/cargo-crev project (manually reviewed code) also mentioned. It's interesting that they mention C/C++ just rely on distros pr

This problem is more far reaching than just extension, and further reaching than what entity is in charge of something. For instance, the worst company imaginable may be in charge of software that was once FOSS, and they may change absolutely nothing about it, so it should be fine. However, if a small update is added that does something bad, you should know about it immediately. The solution seems to be much more clearly in the realm of things like crev: https://github.com/crev-dev/cargo-crev/ Wherein users can get a clear picture of what dependencies are used in the full chain, and how they have been independently reviewed for security and privacy. That's the real solution for the future. A quick score that is available upon display everytime you upgrade, with large warnings for anything above a certain threshold.

There is a similar idea being explored with https://github.com/crev-dev/cargo-crev - you trust a reviewer who reviews crates for trustworthiness, as well as other reviewers.

> a trusted party reviewing code & posting content integrity hashes That sounds like some combination of Crev[0], Sigstore[1], and Trillian[2]. [0] https://github.com/crev-dev/cargo-crev/blob/master/cargo-cre... [1] https://docs.sigstore.dev/ [2] https://transparency.dev/

Rust has a culture where people don't use `unsafe` unless absolutely necessary. That is generally good enough in my experience. If you want to go further, you can disable unsafe in a crate by adding #[forbid(unsafe)]. And if you need more control than that, there's probably tooling out there that will help depending on what exactly you need. https://github.com/rustsec/rustsec/tree/main/cargo-audit https://github.com/rust-secure-code/cargo-geiger https://github.com/crev-dev/cargo-crev