5 ms·
The dependency list[0] looks pretty reasonable, AFAICT the overwhelming majority of that line-of-code count comes from autogenerated Windows API methods. edit
by quodlibetor 3y ago
The dependency list[0] looks pretty reasonable, AFAICT the overwhelming majority of that line-of-code count comes from autogenerated Windows API methods.
edit actual counts:
$ cargo vendor && cd vendor && {
for p in * ; do
echo -n $p
tokei $p | rg '^\s+Rust'
done } | sort -n -k 4 | tabulate
---------------------------- ---- --- ------ ------ ---- ----
errno-dragonfly Rust 2 9 8 0 1
windows_aarch64_gnullvm Rust 2 11 9 0 2
windows_aarch64_msvc Rust 2 11 9 0 2
windows_i686_gnu Rust 2 11 9 0 2
windows_i686_msvc Rust 2 11 9 0 2
windows_x86_64_gnu Rust 2 11 9 0 2
windows_x86_64_gnullvm Rust 2 11 9 0 2
windows_x86_64_msvc Rust 2 11 9 0 2
winapi-i686-pc-windows-gnu Rust 2 25 13 12 0
winapi-x86_64-pc-windows-gnu Rust 2 25 13 12 0
windows-targets Rust 1 54 46 3 5
output_vt100 Rust 2 67 55 0 12
cfg-if Rust 2 164 131 16 17
instant Rust 4 316 260 6 50
countsctor Rust 2 331 254 21 56
errno Rust 5 375 280 41 54
diff Rust 4 561 485 9 67
autocfg Rust 9 702 558 41 103
yansi Rust 7 741 627 3 111
signal-hook-registry Rust 3 818 566 150 102
fastrand Rust 4 830 710 16 104
hermit-abi Rust 4 847 601 5 241
pretty_assertions Rust 5 1231 1072 33 126
glob Rust 2 1589 1291 113 185
bitflags Rust 20 1715 1373 105 237
unicode-ident Rust 11 1794 1697 36 61
signal-hook Rust 17 1969 1520 147 302
tempfile Rust 15 2367 1928 102 337
quote Rust 17 2458 1979 148 331
redox_syscall Rust 23 3595 2996 83 516
log Rust 9 3635 2970 97 568
io-lifetimes Rust 15 4218 3605 80 533
proc-macro2 Rust 17 5286 4514 139 633
cc Rust 13 5861 4767 488 606
rustix Rust 236 39927 33837 1467 4623
syn Rust 92 51956 48946 493 2517
libc Rust 224 109836 99688 2073 8075
linux-raw-sys Rust 61 145628 145455 84 89
winapi Rust 405 179933 176630 3299 4
windows-sys Rust 281 497624 497608 4 12
---------------------------- ---- --- ------ ------ ---- ----
[0]: https://github.com/memorysafety/sudo-rs/blob/60985b2f5f7ffa8030c42b6e8ef78f35e696905d/Cargo.toml#L27-L32 https://github.com/memorysafety/sudo-rs/blob/60985b2f5f7ffa8...
- bayindirh 3y agoAnd this is what that small list of dependencies pulls in: https://github.com/memorysafety/sudo-rs/blob/60985b2f5f7ffa8030c42b6e8ef78f35e696905d/Cargo.lock https://github.com/memorysafety/sudo-rs/blob/60985b2f5f7ffa8...
- jcranmer 3y agoAnd most of those dependencies are only transitive via [dev-dependencies], which causes the entire Windows API to be pulled in.
- bayindirh 3y agoStill doesn’t invalidate the fact that it’s a lot of surface area to hide a targeted attack.
- jcranmer 3y agoIf you're intending to install the package on an image, [dev-dependencies] are not going to be included in the package. So, no, it's not actually relevant to the surface area of the package.
- j16sdiz 3y agoIt matter. The great grandparent was talking about audit for supply chain attacks. dev-dependencies can run on dev machine in compile time
- majewsky 3y agoI see your point, but if you're going to consider all code that runs on the dev machine as a source of supply chain attacks, that's going to include all LOC for the Linux kernel. And the LOC for dev's web browser that they use to browse the issue tracker. And so on.
- oconnor663 3y ago