feat(Unsafe checks): Tell me if there is unsafe code in the crate i am looking at

[peterheesterman]

What do you think needs adding and why?

I would like to see chit have another field added to tell me if a crate uses any unsafe code at all. If not it should have Safe: ✔️ if it does have unsafe code then Safe: ⚔️ .

I want to see this changed because it is an indicator of if i should depend on the crate or not

[lnicola]

Would this take into account the dependencies of the crate?

[peterheesterman]

I was thinking about this, perhaps two entries is best. One that tells you about this crates code and another that checks its dependancies. That way they can be added separately, as including dependancies is going to be a lot more difficult in any performant way.

[lnicola]

This comes up pretty often, but I think most of the crates end up depending transitively on unsafe code. That's the way things go.

[8176135]

cargo-geiger and its library geiger seems to do just this, however it requires the crate to be downloaded to analyze the source code.

Unless crate.io introduces a flag that shows whether unsafe is being used in the crate, I don't see how we can avoid downloading the entire crate.

However, if we do decide to download the crate, it should be relatively simple to unpack the src/ folder to a temporary location, then run the geiger library over it.

[peterheesterman]

I tried out the prototype, very promising. Keen to get this into master eventually.

[8176135]

I'm just going to put all the TODO's for the unsafe-checks-prototype branch here for tracking.

TODOs:

Important

• Implement actual error types for unsafe_check.rs

Possible extra features

• Implement a way to check if the entire crate forbids unsafe (i.e. #![forbid(unsafe_code)] in lib.rs / main.rs) Caveat: lib.rs might not be the root of the crate, since in the Cargo.toml, you can set the root to be whatever you want.
• Maybe implement downloading dependencies and checking them for unsafe as well

Other not so important features

• Add a flag to turn off/on the unsafe check feature, as it increases search completion time by a 1 to 3 seconds. (Not too big an issue, since all the information about the crate is displayed before the downloading actually begins, so users can read through the info as they wait 3 seconds).
• Maybe add a feature that checks if a crate is too big, download and extract on disk instead of directly in memory. (Downloading completely to memory should be fine, as almost every crate is under 1mb.
  The biggest crate I'm aware of is ring, which is only 5.4 mb)