this post was submitted on 06 Aug 2023
14 points (100.0% liked)

Rust Lang

7 readers
1 users here now

Rules [Developing]

Observe our code of conduct

Constructive criticism only

No endless relitigation

No low-effort content

No memes or image macros

No NSFW Content

founded 1 year ago
MODERATORS
 

Cackle is a tool to analyse the transitive dependencies of your crate to see what kinds of APIs each crate uses.

The idea is look for crates that are using APIs that you don't think they should be using. For example a crate that from its description should just be doing some data processing, but is actually using network APIs.

you are viewing a single comment's thread
view the rest of the comments
[–] wisha@lemmy.ml 3 points 1 year ago (1 children)

Amazing project!

Would be cool if we also have an online database of what APIs each crate uses. This would allow quickly knowing some crates are safe without compiling them (there could be malicious build.rs code) or even seeing the source code at all.

[–] DavidLattimore@lemmyrs.org 2 points 1 year ago (1 children)

Interesting idea. It feels to me though that it'd be a lot of work to check such a database for each of your transitive dependencies, where if you just run cackle it checks them all for you and perhaps most importantly will tell you if there's a change.

Another consideration is that cackle only considers an API to be used if it's in reachable code. This is handy because you can for example use a crate like the image crate, which has functions to read and write images on the filesystem and you don't need to grant filesystem permissions unless you actually use those APIs.

[–] wisha@lemmy.ml 1 points 1 year ago* (last edited 1 year ago) (1 children)

What I meant was that I want exactly Cackle, but I don't want to run it on my own computer. If a crate uses some suspicious API (including transitively), I want to know before I download it.

[–] DavidLattimore@lemmyrs.org 1 points 1 year ago

Ah, gotcha. Cackle checks the APIs used by build scripts before it lets them run, so that might help