Release - Next major 0.12.0 - Tracker

[pinkforest]

What would you all lovely people want to see from the next major 0.12.0 breaking version?

I may have assigned you since I would 💜 some feedback from you that would be nice to be included -

Anyone else ofc. more than welcome to give feedback as well :))

If there isn't an issue yet for something that should be included please raise issue so we can

Please note I have skipped the non-breaking issues which can be fixed without major "breaking" change.

There is some category crossover, some of them cannot be done without the other and some can resolve others etc. the usual.

Scanning / Change Analysis Inputs

• How to count rust-bindgen and other FFI? #6
• False positives in easy testcase. #22 - Sub-dependency tree inclusion problem
• Macro expansion #102 (comment) - Consume -Funsafe-code 🔥
• New kid on the block: undetected plutonium #101 - Plutonium! - reddit:the most illegal code
• Macro expansion #102 - Macro expansion
• Detect non-Rust code #103 - Ignore non-rust code
• #145 - Ignore Data (DER)
• Only Analyze Root Crate #190 --Ignore dependencies analysis (it still builds em though)
• Perform analysis over virtual manifest #206 - Virtual manifests
• Geiger Failed to match & Failed to parse - Tracker #240
• Multithreading in scanning phase #269 - @ilyatrefilov 🚀

Improve Reporting Output

• Html output? #10 - Hook to comrak to convert from Github markdown to provide HTML output
• False positives in easy testcase. #22 - Improve pub unsafe fn reporting checking whether these are called at all
• False negative results on dtoa 0.4.4 #82
• Error messages are hard to read #92 - Errors are currently exposed raw JSON - Make them Human readable
• 53 , 119 and #137 - Improve and Differentiate on Test/Development Reporting vs Actual production Deps
• #145 - Improve Warnings | Data / Compile warnings (Minor version fix perhaps)
• Metrics measuring unsafety #152
• Status/Report/Analytics Opt-In Automation rust-secure-code/wg#43 - Support for distributed analytics contributions

Cargo De-Couple - Working currently by @pinkforest

• Add a Dogfooding CI example #63
• Optimize compile times by replacing the dependency on the cargo crate #69 - Use as sub-process only
• #![forbid(unsafe_code)] not detected when depending on a library that has a binary without #![forbid(unsafe_code)] #81 - Ensure required-features and --bin and --lib separation honored
• Allow checking only library, not bin #93 - Ensure required-features and --bin and --lib separation honored (tree_magic)
• Reduce install friction for macOS users #149 - Also use RusTLS ?
• [bug] cargo-geiger fails/errors out when Cargo.toml has nightly features #181 - Nightly features
• CLI Reform with cargo decouple #226 - CompileOptions Reform / gate & mirror CLI options

Cargo Logistics

• Allow checking only library, not bin #93 - Honor Cargo.toml required-features as well as --bin and --lib separation (tree_magic)
• --target not used? #95 - Re-Use Target Directory (architecture mix-up problem)
• Expose --target-dir <dir> #113 - Re-Use Target Directory (relay the flag)
• Cargo geiger deletes the entire target directory without warning #168 - Re-Use Target Directory (prevent removal of directory)

Parsing / Handling

• Detect #[link] directive on extern blocks #179 - [link] directive
• Ignore examples #12 - dtolnay/syn - this crate deserves it's own issue :)
• False positives for the syn crate #11

Geiger.rs

• Add a Dogfooding CI example #63
• Idea: safety badges #150 - Will include the badges as feature there
• Idea - Safety Validations #213
• Status/Report/Analytics Opt-In Automation rust-secure-code/wg#43

Moonshot

Not repo specific stuff but interesting related ideas however

• Community driven crates registry reflector rust-secure-code/wg#42
• Listing lines that can panic in your crate #50

[pinkforest]

As part of major CLI Options changes

There is a tracker issue tying together all the changes in #226

Geiger Dev/Build run types will mirror cargo logically and as result will be separate reports.

All required opts for 0.12.0 will be documented there

[anderejd]

What would you all lovely people want to see from the next major 0.12.0 breaking version?

You already added it to the list, #69 is the one I really wanted to get done when I was actively working on this project 🤩

If everything in the list above gets done for 0.12 then that's a serious upgrade 💪

[anderejd]

Are there any users of cargo geiger here that use the tool in a large project in CI or in the development environment? To get feedback from any such users would be super interesting to me.

[pinkforest]

I'll be using it - in geiger.rs - for the whole ecosystem (crates.io) in distributed environment so I've de-coupled the runner and CLI with traits -

It's taking a bit time - sorry - to do this properly (I hope) as there is a lot of breaking things that need to be addressed same time.

Also I've added clap3 derive as an option to drive CLI and also environment variables only that can be toggled via features that will be handy for CI and reduced binary size / build time.

The runner will support both cargo and clippy but there is a lot of re-structure happening so the de-coupling is major breaking change I'm running on different branch.

I'm still unsure how I can add github etc. repositories but I am thinking that we add a support for reporting the CI run to geiger.rs or even a CD like something like geekbench that would avoid me having to scale geiger.rs to run on all the linked repos too :)

[anderejd]

That's exciting to hear :) Looking forward to following your work, maybe I can find some time to make small contributions along the way to 0.12.

[ilyatrefilov]

I looked up the code in scan part, and.. shouldn't we make it multithreaded?
Now it seems to take too much time to scan solid package ( tokio in my experience), but if user does this , should he care about smth other on the machine?
When it goes to cloud, that is smth to reason about, didn't find some improvement on this in list , so comes the question in :)

[pinkforest]

It's something worth thinking & iterating about -

The runners themselves run multiplexed via multi-process but introducing threading to scanning part has it's own merits -

Can we raise a separate issue about where we can talk & iterate it and I can link it to here into the table.

[pinkforest]

Very nice @ilyatrefilov went and did threading for even in the current codebase scanning, tokio-rs/tokio now just "snaps" now and with a good dependency to have rayon - issue #269 .. and also fixed one of the with "Failure to match" on earlier PR .. good stuff! 🚀