$ the-wire · showcase
Crates.io closes a crate-scope bypass
By RepoJournal · Filed · About Rust · Composed from the cited sources · methodology
13 people shipped this
Turbo87
@Turbo87
1 cited
Jonathan Brouwer
@JonathanBrouwer
1 cited
programskillforverification
@programskillforverification
1 cited
epage
@epage
1 cited
Niloyyy
@Niloyyy
1 cited
bors
@bors
renovate
@renovate
lapla
@lapla-cogito
Bee
@beetrees
Kaileshwar16
@Kaileshwar16
darkraider01
@darkraider01
Ralf Jung
@RalfJung
hlsxx
@hlsxx
A token scoped to one crate name could reach a differently-spelled one, Tokio manifest parsing got 19.4% faster in Cargo, and the invariant checks are tightening across Miri and compiletest.
Check token crate scopes against the stored crate name rust-lang/crates.io
Several crates.io endpoints matched a token's crate scope against the name in the request, while the crate lookup that follows ignores case and treats `-` and `_` as equivalent. A token scoped to `foo_*` could therefore add or remove owners of a crate stored as `foo-bar`, or list and create its Trusted Publishing configs, by requesting `foo_bar`; the user still had to own the crate, so only the...
fix(schema): Improve deserialization errors and performance rust-lang/cargo
Cargo's manifest schema deserialization reduces Tokio's manifest parse and deserialization time by 19.4%, from 130.1 µs to 104.9 µs, measured against Tokio's published Cargo.toml, and drops blank lines from errors while making spans more specific. The author wrote an alternative to `serde-untagged` rather than wait.
Check that the `getsockopt`/`setsockopt` option buffer has the given length rust-lang/miri
Miri now calls `check_ptr_access` for the full length a `getsockopt`/`setsockopt` option buffer claims, so a shim call that lies about its buffer size is diagnosed instead of silently accepted.
Rollup merge of #165576 - fmease:comptest-stricter-parsing, r=jieyouxu rust-lang/rust
compiletest hard-errors on whitespace between `//` and `@` and rejects leading revision conditions like `//[rev]@ dir`, emitting "ERROR: malformed directive: found whitespace". The author judged a warning too easy to miss; any in-tree or out-of-tree test relying on the looser form stops compiling.
fix(lockfile): sort unused patches in Cargo.lock rust-lang/cargo
`[[patch.unused]]` entries were collected from `unused_patches()` without sorting while `[[package]]` entries and each package's `dependencies` were explicitly sorted, so Cargo.lock could churn on unused patches. The entries are now sorted, which should keep lockfile diffs stable.
