Skip to content

Commit 1f1bcbd

Browse files
committed
build: Add error_set and audit unicode-ident
I'm a big fan of `error_set` as a library and am prioritizing auditing it so I can use it in more of my projects guilt-free. I started by auditing `unicode-ident` because it has zero normal dependencies (only dev-dependencies) and a reasonably small linecount. I am not looking forward to auditing `syn`... I am shocked that none of the registry members appear to have even tried to. I know David Tolnay is well-respected and is responsible for quite a few foundational crates, but I figured the sheer influence such crates have in the ecosystem would have warranted SOMEONE auditing them, even if only as a formality. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
1 parent ab06952 commit 1f1bcbd

3 files changed

Lines changed: 120 additions & 1 deletion

File tree

Cargo.lock

Lines changed: 103 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Cargo.toml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ publish = false
2020
[lib]
2121
path = "src/lib/lib.rs"
2222

23+
[dependencies]
24+
error_set = "=0.9.1"
25+
2326
[profile.release]
2427
codegen-units = 1
2528
strip = true

supply-chain/audits.toml

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,17 @@
11

22
# cargo-vet audits file
33

4-
[audits]
4+
[[audits.unicode-ident]]
5+
who = "hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>"
6+
criteria = "safe-to-deploy"
7+
version = "1.0.22"
8+
notes = """
9+
Safety invariants for the two `unsafe` blocks were verified locally using `kani`
10+
`v0.67.0`. The code doesn't appear to do any concerning filesystem access,
11+
network access, or code generation. No effort has been made on my part to verify
12+
the actual correctness of the implementation, but given that the bulk of it
13+
seems to be generated from a specification and the vast majority of the Rust
14+
ecosystem depends on this crate transitively, I'm going to give it the benefit
15+
of the doubt and say it is probably fine, especially since earlier versions have
16+
already been audited by several registry members such as Google and Mozilla.
17+
"""

0 commit comments

Comments
 (0)