logo

Rust crates reviews

Cryptographically verifiable, distributed dependency reviews

reviewer: kornelski

https://lib.rs/kornelski

$ cargo crev repo fetch url https://github.com/kornelski/crev-proofs
$ cargo crev id trust rBGRONmiSLmELT1SuRDDScgLcoJl8mTdEbZqz1XCesM

repo: https://github.com/kornelski/crev-proofs

crate version
rating
date
reviewer
thoroughness, understanding
positive
2020-10-22
kornelski
low, low
alternative:
fxhash
positive
2022-01-13
kornelski
low, low
positive
2021-01-12
kornelski
low, low
positive
2021-01-06
kornelski
low, low
positive
2021-12-06
kornelski
low, medium
positive
2021-11-24
kornelski
medium, medium
positive
2021-02-24
kornelski
low, medium
positive
2021-02-24
kornelski
low, medium
positive
2021-11-18
kornelski
low, medium
positive
2020-10-21
kornelski
low, low
neutral
2021-10-29
kornelski
low, low

Build script is benign. It depends on a bunch of C code, which I haven't checked (hence neutral rating)

positive
2021-07-14
kornelski
low, medium
positive
2022-06-29
kornelski
low, medium
alternative:
cargo-v

Slow due to use of cargo-metadata, and doesn't work with workspaces for no good reason

positive
2021-08-10
kornelski
low, low
neutral
2022-06-29
kornelski
low, medium
alternative:
cargo-bump

Very basic TOML parsing, like sed s/^version/

positive
2022-11-16
kornelski
low, low
neutral
2022-06-29
kornelski
low, medium
alternative:
cargo-bump

Very basic TOML parsing, like sed s/^version/

positive
2021-11-24
kornelski
low, medium
alternative:
parse_cfg
positive
2021-01-20
kornelski
low, medium
neutral
2020-11-02
kornelski
low, low

So much complexity for a bit of backwards-compat :(

positive
2021-08-20
kornelski
low, medium
positive
2021-12-06
kornelski
low, low
positive
2022-09-13
kornelski
low, medium
alternative:
csscolorparser
positive
2022-09-13
kornelski
low, medium
alternative:
css-color-parser2
positive
2022-09-02
kornelski
low, medium
positive
2022-01-04
kornelski
medium, high

Nice and simple. macOS uses hardcoded paths rather than Cocoa APIs, but that's fine.

positive
2021-04-19
kornelski
low, low
positive
2021-01-21
kornelski
low, medium
positive
2021-04-19
kornelski
low, medium
positive
2021-01-19
kornelski
low, medium
positive
2021-07-14
kornelski
low, low
positive
2021-07-14
kornelski
low, medium
positive
2021-06-29
kornelski
low, low
positive
2021-07-14
kornelski
low, medium
positive
2020-09-14
kornelski
low, medium
positive
2020-12-01
kornelski
low, medium
negative
2022-09-08
kornelski
none, none
alternative:
libc

Typosquatting

neutral
2021-08-23
kornelski
low, low

There's a lot of unsafe pointer-juggling here for managing linked lists.

negative
2022-07-05
kornelski
medium, low
alternative:
forage

Warning: this is stolen code

positive
2020-09-14
kornelski
low, low
positive
2021-11-24
kornelski
low, medium
neutral
2021-01-19
kornelski
low, medium

These are helper functions. They aren't actually closures, but plain function pointers.

positive
2020-09-18
kornelski
high, high

Literally nothing to see here

positive
2021-10-29
kornelski
low, low

The build script is benign. It does what it says on the tin. I haven't checked whether definitions match the ABI.

positive
2022-08-19
kornelski
low, low
neutral
2021-02-24
kornelski
high, high
alternative:
cfg-expr
positive
2021-10-05
kornelski
low, medium

It really is a thin wrapper around System.alloc (too bad it can't wrap other allocators)

positive
2021-05-17
kornelski
low, low
negative
2022-07-07
kornelski
low, medium
alternative:
xml-rs

This crate uses a bytewise parser even for files in UTF-16 encoding. It can be tricked into parsing plain text as XML elements (e.g. UTF-16BE "䄼A†⼾" is parsed as <A /> and fires an element event).

positive
2021-11-24
kornelski
low, medium
positive
2021-01-21
kornelski
low, low
positive
2021-01-20
kornelski
high, high
positive
2022-12-12
kornelski
medium, medium
positive
2022-09-20
kornelski
low, medium
positive
2021-01-20
kornelski
low, medium
neutral
2021-02-02
kornelski
medium, medium

It calls unsafe add_cached_mapping

neutral
2021-02-02
kornelski
medium, medium

It doesn't use robust parsing and doesn't validate inputs. It's probably fine anyway.

negative
2021-02-02
kornelski
low, low

Has public functions that take arbitrary raw pointers, but aren't marked as unsafe

positive
2022-09-16
kornelski
low, medium
positive
2022-09-16
kornelski
low, medium
positive
2020-10-21
kornelski
low, low
positive
2020-09-14
kornelski
low, medium
positive
2020-09-14
kornelski
low, medium
positive
2021-05-17
kornelski
low, low
positive
2020-11-13
kornelski
low, low
positive
2021-11-24
kornelski
low, medium
positive
2021-11-24
kornelski
low, medium
positive
2021-08-10
kornelski
low, low
positive
2020-11-13
kornelski
low, medium

it just splits a string

positive
2020-10-19
kornelski
low, low
alternative:
smol_str
positive
2021-05-17
kornelski
low, low

I don't see anything wrong with it, but atomics are notoriously tricky, so please keep in mind that my review is marked with understanding=low

positive
2021-01-06
kornelski
low, medium
positive
2021-08-20
kornelski
low, low
positive
2021-08-20
kornelski
low, low
positive
2020-12-15
kornelski
medium, medium
positive
2021-11-16
kornelski
low, medium

The API of the exponential backoff strategy is surprising, as it uses the same number for the base and the exponent.

positive
2021-05-08
kornelski
low, medium
positive
2021-05-17
kornelski
low, medium
positive
2020-12-15
kornelski
low, low
positive
2021-01-06
kornelski
low, low
negative
2020-10-21
kornelski
low, medium
alternative:
derive_more

TryFrom is now in the standard library, and this library does not fall back to the standard trait.

positive
2022-09-16
kornelski
low, medium
positive
2021-08-10
kornelski
low, medium
neutral
2021-07-14
kornelski
low, low

Uses mem::uninitialized() instead of MaybeUninit or ArrayVec.

negative
2022-07-05
kornelski
medium, low
alternative:
wasmpng

Warning: this is stolen code

positive
2020-10-21
kornelski
low, low
positive
2022-09-20
kornelski
low, medium

The build.rs is benign. The lib? Who knows.

negative
2022-07-05
kornelski
medium, low
alternative:
bbcli

Warning: this is stolen code

© bestia.dev 2023, MIT License, Version: 2023.608.1636

Open source repository for this web app: https://github.com/bestia-dev/cargo_crev_web/