logo

Rust crates reviews

Cryptographically verifiable, distributed dependency reviews

reviewer: kpreid

https://lib.rs/kpreid

$ cargo crev repo fetch url https://github.com/kpreid/crev-proofs
$ cargo crev id trust RFs94ITILUKf6EoC8j-_qwMi4t5zhZ7t3bQ7KHmB5QI

repo: https://github.com/kpreid/crev-proofs

crate version
rating
date
reviewer
thoroughness, understanding
strong
2023-05-23
kpreid
medium, high

Extremely simple crate providing useful trait aliases. The code consists
solely of macro-generated traits and impls; other than the macro_rules
macro itself, all of the crate’s definition is visible in its documentation.
If there were a bug, the worst consequence would likely be dependents failing
to compile, since none of the code is statements or expressions to execute
at run time.

positive
2023-05-29
kpreid
low, medium

Contains no unsafe code. Contains no IO. Straightforward and well organized
code, though the number of different cases and scenarios it handles makes
it daunting to thoroughly comprehend. Well commented. Extensive tests.

I have not reviewed the correctness of the algorithms or their resistance
to DoS attacks (i.e. whether they can enter infinite loops or over-allocate).
I have examined each line to check that it is not obviously malicious or
obfuscated.

neutral
2023-06-03
kpreid
low, low

Contains some straightforward unsafe code:

  • [i8][u8] and Vec<u8>Vec<i8> reinterpretations.
  • Converting UTF-8 Strings to bytes and then relying on the bytes being UTF-8.

Contains no IO operations (std::fs etc.) except in the examples.

I have not reviewed the correctness of the algorithms.
I have examined the code to check that it is not obviously malicious or
obfuscated, and that it looks like the kind of code that does what it is
supposed to (that is: implement a de/serializer).

positive
2023-05-23
kpreid
medium, high

This proc-macro crate defines an attribute macro #[mutants::skip] which
always returns its input unchanged (i.e. the attribute has no effect).

The attribute is detected by the cargo-mutants tool when it parses source
code. It should be completely safe and have no effect unless you are using
cargo-mutants (which this is not a review of).

© bestia.dev 2023, MIT License, Version: 2023.608.1636

Open source repository for this web app: https://github.com/bestia-dev/cargo_crev_web/