mimblewimble/grin

Limit exposure to dependencies weaknesses

Open

#2,026 opened on Nov 27, 2018

View on GitHub
 (5 comments) (1 reaction) (0 assignees)Rust (991 forks)batch import
good first issuehelp wantedtask

Repository metrics

Stars
 (4,876 stars)
PR merge metrics
 (Avg merge 6d 11h) (25 merged PRs in 30d)

Description

I think we've all had this in mind for quite a while but this was a direct reminder (widely used npm package with newly injected malicious code):

https://github.com/dominictarr/event-stream/issues/116

I don't think we should worry about auditing every single of our dependencies and Rust does a good job at protecting us from some of these attacks. At this stage I'm also not too worried about crates.io getting hacked. But I do think we should at least make sure every single of our dependency is pinned to a specific version.

Contributor guide

Research direction
Identify all dependencies in Cargo.toml that are not pinned to a specific version and update them to exact version numbers.
Tech stack
rust
Domain
security
Issue type
Refactor
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
RustCargo
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
85