mimoo/cargo-dephell

Cargo dephell analyzes the third-party dependencies of a Rust workspace

😳 Hello you!

I'm David Wong. I'm a founder of zkSecurity. I was previously a cryptography engineer working on the Mina cryptocurrency at O(1) Labs. I'm also the author of the book Real-World Cryptography. I used to be the security lead on the Diem blockchain (formely known as Libra), working from Novi (Facebook). Before that I was a security consultant at Cryptography Services (NCC Group).

You can find more about what I do on my crypto blog cryptologie.net or my portfolio davidwong.fr.

You should also check my podcast.

cargo-dephell's Issues

Error computing package graph windows-targets: unknown target triple: aarch64-pc-windows-gnullvm

When dephell is run on a bare-bones crate that has windows-targets, it crashes with the error

Error while computing package graph: for package 'windows-targets 0.52.0 (registry+https://github.com/rust-lang/crates.io-index)': for dependency 'windows_aarch64_gnullvm', parsing target 'aarch64-pc-windows-gnullvm' failed: unknown target triple: aarch64-pc-windows-gnullvm

This might be related to this issue.

Note: the aarch64-pc-windows-gnullvm target is a tier 3 target, but is used in this context even on tier 1, so cargo-dephell shouldn't crash.

How to reproduce:

cargo new test_dephell
cd test_dephell
cargo add windows-targets
cargo build
cargo-dephell -m Cargo.toml -o test.html

repeative dependencies - need tests

there are some inconsistencies, this repo really needs a sample repo to test again. I think our use of guppy is imperfect

other signals?

• number of github issues
• code on github matching the code on crates.io
• status/number of issues reported in rust-advisory
• cargo-crev score
• number of rustsec advisories
• all tests passed?
• amount of test code
• version number

Support disabling GitHub stars check

When just running the tool on the command-line with only specifying --manifest-path and -o it still seems to do the GitHub stars check which caused it to fail for me on most crates with this:

text: Ok("{\"message\":\"API rate limit exceeded for aaa.bbb.ccc.ddd. (But here\'s the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)\",\"documentation_url\":\"https://developer.github.com/v3/#rate-limiting\"}\n")
dephell: crates.io request failed
status: 403 Forbidden

I hadn't set up a personal access token or specified it yet, maybe change to not do the stars check if --github-token is not specified?

Running cargo-dephell on Firefox (mozilla-central) on Mac fails trying to compile windows-specific crates

I'd love to run cargo-dephell against Firefox, but have hit some issues. STR:

git clone --depth 1 [email protected]:mozilla/gecko-dev.git
cd gecko-dev
echo "" > modules/libpref/init/static_prefs/src/lib.rs
cargo dephell -o analysis_results.html

The third step neuters the static_prefs crate, which depends on some build-time shenanigans [1], and allows you to reach the relevant error without needing to set your environment up for an actual Firefox build.

[1] https://searchfox.org/mozilla-central/rev/9bf82ef9c097ee6af0e34a1d21c073b2616cc438/modules/libpref/init/static_prefs/src/lib.rs#13

address cargo request limits

https://crates.io/policies#crawlers

cargo geiger misused?

cargo geiger seems to pick up some unsafe code in pin-project, but not when used in dephell:

Unknown target_os in Ring

When trying to use cargo-dephell in a project that has a dep on ring it failswith the following error:

Error while computing package graph: for package 'ring 0.16.19 (registry+https://github.com/rust-lang/crates.io-index)': for dependency 'once_cell', parsing target 'cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "illumos", target_os = "netbsd", target_os = "openbsd", target_os = "solaris"))' failed: invalid cfg() expression: any(target_os = "dragonfly", target_os = "freebsd", target_os = "illumos", target_os = "netbsd", target_os = "openbsd", target_os = "solaris")
                                                                 ^^^^^^^ expected one of `haiku`, `openbsd`, `freebsd`, `redox`, `vxworks`, `uefi`, `emscripten`, `netbsd`, `fuchsia`, `cloudabi`, `wasi`, `solaris`, `cuda`, `dragonfly`, `l4re`, `android`, `macos`, `hermit`, `linux`, `windows`, `unknown`, `ios` here

I suppose maybe updating Cargo already does the trick.

Tried with latest cargo-dephell from crates.io