Skip to content

rustsec: Fix git2 via cargo-edit-9 fork#831

Merged
Shnatsel merged 2 commits intorustsec:mainfrom
pinkforest:fix-dep-cargo-edit-9-fork
Mar 21, 2023
Merged

rustsec: Fix git2 via cargo-edit-9 fork#831
Shnatsel merged 2 commits intorustsec:mainfrom
pinkforest:fix-dep-cargo-edit-9-fork

Conversation

@pinkforest
Copy link
Copy Markdown
Contributor

@pinkforest pinkforest commented Mar 20, 2023

Fixes #830
Supercedes #801

packed_simd_2 is similar how it's used. Can use this and gradually do something about it e.g. minify it for our purposes.

I've worked 0.9 with dependency bumps to: https://github.com/pinkforest/cargo-edit-9

crates-index also has to be bumped to 0.19 that picks up 0.16 git2

This was according to recommendation here:

Copy link
Copy Markdown
Member

@Shnatsel Shnatsel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, thanks for doing this!

I'd like to get an LGTM from @tarcieri as well before we ship this, but it does look like a good approach and it'd be nice to get this shipped ASAP.

@Shnatsel Shnatsel requested a review from tarcieri March 20, 2023 12:49
@Shnatsel
Copy link
Copy Markdown
Member

I'll go ahead and ship it.

@Shnatsel Shnatsel merged commit e50b7e6 into rustsec:main Mar 21, 2023
@tarcieri
Copy link
Copy Markdown
Member

It's fine, though I would like to finish getting the parts we need vendored, especially as they're useful for implementing other features

@pinkforest
Copy link
Copy Markdown
Contributor Author

There are other people who need this as well so I think keeping it as a crate but more for our purposes could work ?

@tarcieri
Copy link
Copy Markdown
Member

We only need a small subset of the functionality, and it currently has a lot of hard dependencies which are unnecessary for our purposes, which is why fix is currently gated under a feature.

I have a WIP branch partly finished to extract the requisite functionality which also eliminates the need to feature-gate fix, which I think would make it a lot more discoverable.

There are also private APIs it would be nice to have visible within the rustsec crate itself.

@pinkforest
Copy link
Copy Markdown
Contributor Author

pinkforest commented Mar 21, 2023

yeah the deps are a lot, I thought about vendoring and thought it's a lot of work and thought you might have something in the oven so temporary stopgap then

What I meant more is that can we make it separate crate so we can offer this to others w/o having to use rustsec ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Resolve CVE-2023-22742 stemming from git2 dependency.

3 participants