mimblewimble/grin

Limit exposure to dependencies weaknesses

Open

#2,026 建立於 2018年11月27日

在 GitHub 查看
 (5 留言) (1 反應) (0 負責人)Rust (4,876 star) (991 fork)batch import
good first issuehelp wantedtask

描述

I think we've all had this in mind for quite a while but this was a direct reminder (widely used npm package with newly injected malicious code):

https://github.com/dominictarr/event-stream/issues/116

I don't think we should worry about auditing every single of our dependencies and Rust does a good job at protecting us from some of these attacks. At this stage I'm also not too worried about crates.io getting hacked. But I do think we should at least make sure every single of our dependency is pinned to a specific version.

貢獻者指南

技術棧
rust
領域
security
議題類型
security
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Rust basicsCargo.tomldependency pinning concepts
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
60
研究方向
The issue calls for pinning all dependencies to specific versions to mitigate supply chain attacks. First, examine the current Cargo.toml and Cargo.lock to identify unpinned dependencies. Then, research best practices for pinning in Rust, such as using exact versions or using `cargo update` to lock versions. The maintainers should decide on a policy and implement it in a PR that updates version specifiers. Consider also auditing if any dependencies already use [patch] or [replace] sections.