On Wed, Jan 24, 2024 at 09:37:27AM +0100, Simon Josefsson wrote: > Simon Josefsson <si...@josefsson.org> writes: > > >> > My naive approach on how to fix a security problem in package X > >> > which is > >> > statically embedded into other packages A, B, C, ... would be to > >> > rebuild > >> > the transitive closure of all packages that Build-Depends on X and > >> > publish a security update for all those packages. > ... > > I realized that there is one problem with my approach: consider if > > package A was built via Build-Depends package B of version X and that > > later package B is upgraded to X+1 in Debian. Then if a security > > problem happens in B we need to rebuild A. It may be that package A no > > longer builds due to some incompatibility between version X and X+1 of > > B. This would not be noticed until a full rebuild of an archive is > > done, or when the security teams wants to rebuild the transitive > > closure of the Build-Depends graph for a package. > > Having reflected a bit, and learned through my own experience and > others' insights [1] that Go Build-Depends are not transitive, I'd like > to update my proposal on how to handle a security bug in any Go/Rust/etc > package and the resulting package rebuilds: > > To fix a security problem in package X, which is used during build > (through statical linking, vendoring, or some other mechanism) to > build package A, B, C, ... you need to rebuild all packages that > Build-Depends on X (lets call this step 1) and all packages that > Build-Depends on any of the packages that will be rebuilt during step > 1. This rebuild process is iterated until no more packages remains to > be rebuild, and all packages have been rebuilt using newly rebuild > packages. If there are cyclical dependencies (which unfortunately are > common), you have to loop until all packages have been rebuilt with a > clean dependency chain, and detect the loop and stop rebuilding. If > there are FTBFS errors during the rebuilds, this will have to be > patched too. > > Yes, for a low-level Go package (e.g., golang-golang-x-net-dev), this > will mean rebuilding almost all of the Go packages in Debian and publish > them in a security advisory. > > This algorithm can be optimized (i.e., reduce the number of packages to > publish in an advisory) by either of: > > 1) using information from Built-Using: (which was not designed for > this purpose, so this is fragile) or *.buildinfo. > > 2) by dropping all 'Architecture: all' packages that does not embedd > the buggy code. > > The last optimization 2) would reduce the number of Go packages to > publish significantly, as it would drop most golang-*-dev packages. I > think this actually makes this process feasible in practice, as there > are relatively few binary packages written in Go. > > This method applies to non-Go/Rust too, if there are such security > problems and reverse build chains. > > I think all of this (except maybe the optimization 2) which requires > code comparisons) can be automated in a GitLab pipeline for higher > confidence of the result.
Here's some rough thoughts and numbers for the (packaged) Rust ecosystem.. Currently in unstable we have ~100 packages shipping binaries written in Rust that are packaged using the "stock" packaging schema (that's debcargo/debcargo-conf + dh-cargo + our cargo wrapper) or Jonas' forked one (which use a slightly different, but mostly compatible approach), which means dh-cargo-built-using is called and encodes the static linking information in the binary package in X-Cargo-Built-Using[0]. Let's add another 50[1] that are using Rust in some fashion and thus (potentially) contain statically linked Rust code from other source packages, which are for whatever reason currently not emitting this information - some examples: src:cargo, src:rustc - these both vendor their deps and need special handling anyhow, firefox and soon chromium (similar AFAIK), but also more relevant, python3-cryptography and friends, or parts of Gnome that are newly or re-written in Rust (these could and should emit the information, but currently don't). These are the only packages (besides the librust-foo-dev package triggering a rebuild) that need a rebuild right now if a security fix needs to be deployed. But thankfully we don't need to rebuild 1xx Rust-using packages whenever any crate has a security fix, we only need to do so if they transitively build-depend on the vulnerable (now fixed) package/crate. This in effect also means that (for simple cases where the vulnerability is not spread across multiple crates) we can rebuild the vulnerable (lib) crate first, and then schedule independent rebuilds of all binary-shipping packages that statically link it. I attached a list doing a rough mapping of source package to number of such packages needing a rebuild if the source package in question gets a security fix. In my experience (both packaging Rust things in Debian, but also developing software in it) it's a pretty accurate depiction of what I would consider "core" crates for things that make sense to package in Debian (e.g., notably a lot of web- and wasm-related stuff is missing). The crates with high "linkage" count are those low in the stack - terminal, OS/kernel, error handling, data structures, and similar stuff. the median "rebuild count" (already ignoring rust crates that are only used for testing, or no longer used, or not yet used by an application) is 2, which would mean 3 rebuilt packages. all of this is just a rough approximation of course. To give you a concrete example: rust-shlex recently had an upload fixing a vulnerability. grep-ctrl tells me *only* bindgen statically links this (false negatives for lack of information are possible of course!). In this case it's a direct build dependency (of rust-bindgen-cli which builds bindgen), trivial case. bindgen itself would be another special case - it's a library but also CLI tool for generating (Rust) bindings at build time - something commonly employed in -sys crates that link to regular C libraries. Even more so in Debian, since we (usually) strip both pre-generated bindings and bundled copies of those C libraries from upstream sources. If there is a vulnerability affecting bindgen-generated bindings in a systematic fashion, we'd need to take a look at everything using it to generate bindings - something not covered by the current tooling - even though nothing (except the bindgen CLI tool) statically links bindgen the library (but just its output). Let's say there's a hypothetical vulnerability in rust-zstd-sys (the crate providing bindings for libzstd - the actual C lib is dynamically linked in this case). grep-dctrl tells me there are 3 binary packages containing binaries statically linking this crate: oxigraph-server rustup sccache None of them directly Build-Depend on librust-zstd-sys-dev (they all rightfully use the high-level abstraction in src:rust-zstd / bin:librust-zstd-dev). There is no need to rebuild the intermediate packages librust-zstd-safe-dev or librust-zstd-dev if the fix is in librust-zstd-sys-dev, since by definition they only contain source code. If we deem the special info in binary packages not complete enough (for the time being, this should be improved IMHO!) looking at the buildinfo files gives us similar information with more overshoot (after all, what wasn't installed at the time of building couldn't have been statically linked, but not everything that was around necessarily ended up in the built binary package). At least for debcargo-conf originating packages, librust-X-dev should only every contain source code and metadata, and no build artifacts/binaries whatsoever and can thus be ignored for the purpose of finding packages to be rebuilt (of course, like mentioned above, except for the case where it is the crate containing the vulnerability in the first place, or multiple packages requiring changes to actually fix the vulnerability). Filtering for Rust binaries in some other fashion would serve the same purpose. For anybody interested in discussing the interaction between distros and upstreams and related pain points (although the focus will be on how to do upstream development and releases in a distro friendly fashion), there will be a Rust distro BoF at FOSDEM next week (time and place hopefully announced soon). 0: soon to be switched over to the language agnostic Static-Built-Using also used by go packages 1: generous, there's 37 source package not starting with 'rust-' that B-D on rustc, and that includes rustc, cargo, and a few already included in the ~100 count above
1 rust-aead 1 rust-aes 1 rust-aes-siv 1 rust-alacritty-config 1 rust-alacritty-terminal 1 rust-aliasable 1 rust-alloc-no-stdlib 1 rust-alloc-stdlib 1 rust-anes 1 rust-annotate-snippets 1 rust-ansiterm 1 rust-app-dirs2 1 rust-approx 1 rust-arbitrary 1 rust-argmax 1 rust-argparse 1 rust-ascii-canvas 1 rust-askama 1 rust-askama-escape 1 rust-assert-fs 1 rust-async-channel 1 rust-async-compression 1 rust-async-executor 1 rust-async-global-executor 1 rust-async-std 1 rust-async-task 1 rust-atk 1 rust-atk-sys 1 rust-atom 1 rust-atomic 1 rust-atomic-waker 1 rust-auditable-serde 1 rust-backtrace-sys 1 rust-base32 1 rust-base-x 1 rust-bat 1 rust-bindgen 1 rust-bindgen 1 rust-biquad 1 rust-bitfield 1 rust-bit-set 1 rust-bit-vec 1 rust-blake2 1 rust-blocking 1 rust-bmap-parser 1 rust-box-drawing 1 rust-brotli 1 rust-brotli-decompressor 1 rust-bytecount 1 rust-bytelines 1 rust-byte-unit 1 rust-calloop 1 rust-capng 1 rust-capstone 1 rust-capstone-sys 1 rust-cargo-binutils 1 rust-cast 1 rust-cbindgen 1 rust-cexpr 1 rust-cfb 1 rust-chrono-tz 1 rust-chunked-transfer 1 rust-ciborium 1 rust-ciborium-io 1 rust-ciborium-ll 1 rust-cid 1 rust-cipher 1 rust-clang-sys 1 rust-clap-complete-3 1 rust-clap-num 1 rust-clap-verbosity-flag 1 rust-clipboard 1 rust-clone-file 1 rust-cmac 1 rust-color-eyre 1 rust-color-print 1 rust-color-spantrace 1 rust-colorsys 1 rust-concat-string 1 rust-config 1 rust-configparser 1 rust-console-error-panic-hook 1 rust-const-format 1 rust-copypasta 1 rust-core2 1 rust-cpal 1 rust-cpp 1 rust-cpp-demangle 1 rust-cp-r 1 rust-criterion 1 rust-crossfont 1 rust-cryptoki 1 rust-cryptoki-sys 1 rust-cty 1 rust-cvt 1 rust-daemonize 1 rust-dashmap 1 rust-data-encoding-macro 1 rust-datetime 1 rust-dbl 1 rust-debugid 1 rust-deunicode 1 rust-dhcp4r 1 rust-dialoguer 1 rust-difference 1 rust-directories 1 rust-dlib 1 rust-dlv-list 1 rust-dns-lookup 1 rust-dns-parser 1 rust-dotenv 1 rust-dotenvy 1 rust-downcast-rs 1 rust-dtoa 1 rust-edit-distance 1 rust-effective-limits 1 rust-ena 1 rust-encoding-rs-io 1 rust-enum-map 1 rust-enum-primitive 1 rust-enum-unitary 1 rust-env-proxy 1 rust-erbium-core 1 rust-erbium-net 1 rust-escargot 1 rust-exacl 1 rust-expat-sys 1 rust-eyre 1 rust-fasteval 1 rust-fern 1 rust-field-offset 1 rust-fragile 1 rust-freetype 1 rust-freetype-rs 1 rust-freetype-sys 1 rust-fs-at 1 rust-fs-err 1 rust-fst 1 rust-fxhash 1 rust-gdk4 1 rust-gdk4-sys 1 rust-gdk-sys 1 rust-git-testament 1 rust-glutin 1 rust-glutin-egl-sys 1 rust-glutin-glx-sys 1 rust-goblin 1 rust-graphene-rs 1 rust-graphene-sys 1 rust-grep-matcher 1 rust-grep-pcre2 1 rust-grep-printer 1 rust-grep-regex 1 rust-grep-searcher 1 rust-gsk4 1 rust-gsk4-sys 1 rust-gtk4 1 rust-gtk4-sys 1 rust-gtk-sys 1 rust-gumdrop 1 rust-html-escape 1 rust-humansize 1 rust-human-sort 1 rust-indenter 1 rust-infer 1 rust-inout 1 rust-insta 1 rust-instant 1 rust-ipnetwork 1 rust-is-debug 1 rust-jargon-args 1 rust-json-event-parser 1 rust-kstring 1 rust-kv-log-macro 1 rust-lexiclean 1 rust-lexopt 1 rust-liboverdrop 1 rust-libseccomp-sys 1 rust-libslirp 1 rust-libslirp-sys 1 rust-libsystemd 1 rust-libusb1-sys 1 rust-lliw 1 rust-loopdev 1 rust-lv2 1 rust-lv2-atom 1 rust-lv2-core 1 rust-lv2-midi 1 rust-lv2-sys 1 rust-lv2-units 1 rust-lv2-urid 1 rust-lz4 1 rust-lz4-flex 1 rust-lzma-rs 1 rust-lzma-sys 1 rust-mbox 1 rust-md5 1 rust-mio-uds 1 rust-multibase 1 rust-multihash 1 rust-multihash-codetable 1 rust-multihash-derive 1 rust-natord 1 rust-nb-connect 1 rust-nbd 1 rust-netlink-packet-core 1 rust-netlink-packet-route 1 rust-netlink-packet-utils 1 rust-netlink-sys 1 rust-new-debug-unreachable 1 rust-nitrokey 1 rust-nitrokey-sys 1 rust-nom-derive 1 rust-no-std-compat 1 rust-ntp-os-clock 1 rust-ntp-proto 1 rust-ntp-udp 1 rust-num-enum 1 rust-num-format 1 rust-nutmeg 1 rust-nvml-wrapper 1 rust-nvml-wrapper-sys 1 rust-oorandom 1 rust-ordered-multimap 1 rust-os-display 1 rust-ouroboros 1 rust-owo-colors 1 rust-oxhttp 1 rust-oxilangtag 1 rust-oxiri 1 rust-pager 1 rust-pam 1 rust-pam-sys 1 rust-papergrid 1 rust-parsec-client 1 rust-partition-identity 1 rust-path-slash 1 rust-pcap-sys 1 rust-pcre2 1 rust-pcre2-sys 1 rust-peeking-take-while 1 rust-peekread 1 rust-peg 1 rust-pest 1 rust-pinger 1 rust-pipeline 1 rust-pktparse 1 rust-plain 1 rust-plotters 1 rust-plotters-backend 1 rust-plotters-svg 1 rust-png 1 rust-postgres 1 rust-postgres-protocol 1 rust-postgres-types 1 rust-precomputed-hash 1 rust-prettyplease 1 rust-procfs 1 rust-proc-mounts 1 rust-prometheus 1 rust-pulldown-cmark 1 rust-pure-rust-locales 1 rust-pyo3 1 rust-pyo3-log 1 rust-pythonize 1 rust-quick-protobuf 1 rust-raw-window-handle 1 rust-rcgen 1 rust-reduce 1 rust-remove-dir-all 1 rust-rio 1 rust-rmp 1 rust-rmp-serde 1 rust-rockfile 1 rust-roff 1 rust-rs-tracing 1 rust-rusb 1 rust-rust-code-analysis 1 rust-rust-decimal 1 rust-rust-embed 1 rust-rust-embed-utils 1 rust-rusticata-macros 1 rust-rust-ini 1 rust-rust-unixfs 1 rust-scroll 1 rust-sctk-adwaita 1 rust-sd-notify 1 rust-seccomp-sys 1 rust-semver-0.9 1 rust-semver-parser 1 rust-semver-parser-0.7 1 rust-sequoia-autocrypt 1 rust-sequoia-wot 1 rust-serde-cbor 1 rust-serde-with 1 rust-serial 1 rust-serial-test 1 rust-servo-fontconfig 1 rust-servo-fontconfig-sys 1 rust-sha2-asm 1 rust-shadow-rs 1 rust-shlex 1 rust-simplelog 1 rust-slice-group-by 1 rust-slog 1 rust-slog-async 1 rust-slog-term 1 rust-slotmap 1 rust-slug 1 rust-smallbitvec 1 rust-smithay-client-toolkit 1 rust-smithay-clipboard 1 rust-smol 1 rust-smol-str 1 rust-snafu 1 rust-sop 1 rust-starship-battery 1 rust-statistical 1 rust-strfmt 1 rust-strict-num 1 rust-string-cache 1 rust-stringprep 1 rust-subprocess 1 rust-symbolic-common 1 rust-symbolic-demangle 1 rust-syscallz 1 rust-sys-info 1 rust-sys-locale 1 rust-sys-mount 1 rust-tabled 1 rust-tabwriter 1 rust-take 1 rust-take-mut 1 rust-target 1 rust-tera 1 rust-term-grid 1 rust-test-case 1 rust-timeago 1 rust-tiny-http 1 rust-tiny-skia 1 rust-tiny-skia-path 1 rust-tinytemplate 1 rust-tls-parser 1 rust-tokio-postgres 1 rust-tokio-serde 1 rust-tokio-socks 1 rust-tokio-stream 1 rust-topological-sort 1 rust-tower-layer 1 rust-tracing-appender 1 rust-tracing-error 1 rust-tree-sitter-config 1 rust-tree-sitter-highlight 1 rust-tree-sitter-loader 1 rust-tree-sitter-tags 1 rust-tss-esapi 1 rust-tss-esapi-sys 1 rust-tui 1 rust-typed-arena 1 rust-ucd-parse 1 rust-ucd-util 1 rust-uname 1 rust-unescape 1 rust-unic-char-property 1 rust-unic-char-range 1 rust-unic-common 1 rust-unic-segment 1 rust-unic-ucd-segment 1 rust-unic-ucd-version 1 rust-unsigned-varint 1 rust-uom 1 rust-urid 1 rust-urlencoding 1 rust-utf8-ranges 1 rust-uucore 1 rust-uutils-term-grid 1 rust-value-bag 1 rust-vhost 1 rust-vhost-user-backend 1 rust-virtio-bindings 1 rust-virtio-queue 1 rust-vm-memory 1 rust-vmm-sys-util 1 rust-vsort 1 rust-wasm-bindgen 1 rust-wayland-client 1 rust-wayland-client-0.29 1 rust-wayland-commons 1 rust-wayland-cursor 1 rust-wayland-cursor-0.29 1 rust-wayland-protocols 1 rust-wayland-protocols-0.29 1 rust-wayland-sys 1 rust-wayland-sys-0.29 1 rust-webbrowser 1 rust-whoami 1 rust-winit 1 rust-wmidi 1 rust-x11-dl 1 rust-xcursor 1 rust-xz 1 rust-xz2 1 rust-yansi-term 1 rust-yasna 1 rust-zbus 1 rust-zbus-1 1 rust-zmq 1 rust-zmq-sys 1 rust-zoneinfo-compiled 1 rust-zvariant 1 rust-zvariant-2 2 rust-alsa 2 rust-alsa-sys 2 rust-arc-swap 2 rust-ascii 2 rust-async-io 2 rust-async-lock 2 rust-blake3 2 rust-bzip2 2 rust-bzip2-sys 2 rust-cairo-rs 2 rust-cairo-sys-rs 2 rust-caps 2 rust-chrono-humanize 2 rust-clircle 2 rust-concurrent-queue 2 rust-constant-time-eq 2 rust-content-inspector 2 rust-crc-catalog 2 rust-crunchy 2 rust-csv 2 rust-csv-core 2 rust-dot-writer 2 rust-dunce 2 rust-endian-type 2 rust-enumflags2 2 rust-enum-iterator 2 rust-errno 2 rust-etcetera 2 rust-event-listener 2 rust-faccess 2 rust-fast-srgb8 2 rust-fs2 2 rust-futures-lite 2 rust-gdk 2 rust-gdk-pixbuf 2 rust-gdk-pixbuf-sys 2 rust-gio 2 rust-gio-sys 2 rust-glib 2 rust-glib-sys 2 rust-globwalk 2 rust-gobject-sys 2 rust-gtk 2 rust-half 2 rust-hyper-rustls 2 rust-indicatif 2 rust-iovec 2 rust-json 2 rust-libm 2 rust-linemux 2 rust-locale 2 rust-maybe-uninit 2 rust-mio-0.6 2 rust-mio-extras 2 rust-net2 2 rust-nibble-vec 2 rust-normpath 2 rust-numtoa 2 rust-oid 2 rust-openpgp-cert-d 2 rust-palette 2 rust-pango 2 rust-pango-sys 2 rust-parsec-interface 2 rust-path-abs 2 rust-picky-asn1 2 rust-picky-asn1-der 2 rust-picky-asn1-x509 2 rust-pico-args 2 rust-polling 2 rust-pretty-env-logger 2 rust-prost 2 rust-protobuf 2 rust-psa-crypto 2 rust-psa-crypto-sys 2 rust-radix-trie 2 rust-retry 2 rust-rustc-cfg 2 rust-rustc-version 2 rust-scoped-threadpool 2 rust-scoped-tls 2 rust-secrecy 2 rust-sequoia-cert-store 2 rust-sequoia-net 2 rust-sequoia-policy-config 2 rust-serde-bytes 2 rust-shellexpand 2 rust-similar 2 rust-simple-logger 2 rust-stable-deref-trait 2 rust-std-prelude 2 rust-string 2 rust-syn-1 2 rust-syntect 2 rust-termion 2 rust-threadpool 2 rust-tiny-keccak 2 rust-tokio-rustls 2 rust-tracing-log 2 rust-tree-sitter 2 rust-trust-dns-client 2 rust-ucd 2 rust-ucd-trie 2 rust-unicase 2 rust-users 2 rust-utf8-width 2 rust-uzers 2 rust-waker-fn 2 rust-x11 2 rust-x11-clipboard 2 rust-xcb 2 rust-zbase32 3 rust-arrayref 3 rust-assert 3 rust-assert-cmd 3 rust-base16ct 3 rust-base64ct 3 rust-bitmaps 3 rust-cargo-util 3 rust-cc 3 rust-const-oid 3 rust-crates-io 3 rust-crossbeam-queue 3 rust-crypto-bigint 3 rust-ct-codecs 3 rust-der 3 rust-difflib 3 rust-dirs-next 3 rust-dirs-sys-next 3 rust-ecdsa 3 rust-ed25519 3 rust-ed25519-compact 3 rust-elliptic-curve 3 rust-failure 3 rust-ff 3 rust-fiat-crypto 3 rust-float-cmp 3 rust-git2-curl 3 rust-grep 3 rust-grep-cli 3 rust-group 3 rust-heck 3 rust-hkdf 3 rust-http-auth 3 rust-im-rc 3 rust-inotify 3 rust-inotify-sys 3 rust-libnghttp2-sys 3 rust-libssh2-sys 3 rust-line-wrap 3 rust-lru 3 rust-lru-cache 3 rust-lscolors 3 rust-normalize-line-endings 3 rust-notify 3 rust-num-complex 3 rust-num-iter 3 rust-onig 3 rust-onig-sys 3 rust-ordered-float 3 rust-orion 3 rust-os-info 3 rust-p384 3 rust-pasetors 3 rust-pem-rfc7468 3 rust-pkcs8 3 rust-plist 3 rust-portable-atomic 3 rust-predicates 3 rust-predicates-core 3 rust-predicates-tree 3 rust-primeorder 3 rust-rand-xoshiro 3 rust-ratatui 3 rust-resolv-conf 3 rust-rfc6979 3 rust-rgb 3 rust-rpassword 3 rust-rtoolbox 3 rust-rustc-workspace-hack 3 rust-rustfix 3 rust-ruzstd 3 rust-safemem 3 rust-sec1 3 rust-serde-ignored 3 rust-serde-value 3 rust-shell-escape 3 rust-signature 3 rust-sized-chunks 3 rust-spki 3 rust-sysinfo 3 rust-syslog 3 rust-termtree 3 rust-trust-dns-proto 3 rust-trust-dns-resolver 3 rust-twox-hash 3 rust-yansi 3 rust-zip 3 rust-zstd 3 rust-zstd-safe 3 rust-zstd-sys 4 rust-ansi-colours 4 rust-bytemuck 4 rust-cassowary 4 rust-crossterm 4 rust-curl 4 rust-curl-sys 4 rust-doc-comment 4 rust-error-chain 4 rust-fd-lock 4 rust-jobserver 4 rust-md-5 4 rust-mime 4 rust-number-prefix 4 rust-num-bigint 4 rust-num-integer 4 rust-num-rational 4 rust-opener 4 rust-pem 4 rust-quick-error 4 rust-reqwest 4 rust-rustc-hash 4 rust-rustls 4 rust-rustls-native-certs 4 rust-rustls-pemfile 4 rust-rustls-webpki 4 rust-serde-urlencoded 4 rust-shell-words 4 rust-strip-ansi-escapes 4 rust-term-size 4 rust-tinyvec 4 rust-tinyvec-macros 4 rust-unicode-xid 4 rust-which 4 rust-wild 4 rust-xdg 5 rust-addr2line 5 rust-buffered-reader 5 rust-diff 5 rust-dyn-clone 5 rust-fallible-streaming-iterator 5 rust-fixedbitset 5 rust-gimli 5 rust-hashlink 5 rust-hyper-tls 5 rust-libloading 5 rust-libsqlite3-sys 5 rust-memmap2 5 rust-memsec 5 rust-minimal-lexical 5 rust-native-tls 5 rust-nettle 5 rust-nettle-sys 5 rust-nom 5 rust-pathdiff 5 rust-petgraph 5 rust-proc-macro2 5 rust-quote 5 rust-ring 5 rust-rusqlite 5 rust-sct 5 rust-sequoia-openpgp 5 rust-sha1collisiondetection 5 rust-signal-hook-mio 5 rust-spin 5 rust-tokio-native-tls 5 rust-tracing-subscriber 5 rust-unicode-ident 5 rust-untrusted 5 rust-wait-timeout 5 rust-xattr 5 rust-xxhash-rust 6 rust-backtrace 6 rust-bytesize 6 rust-cargo-metadata 6 rust-ctrlc 6 rust-data-encoding 6 rust-foreign-types-0.3 6 rust-foreign-types-shared-0.1 6 rust-h2 6 rust-hmac 6 rust-hostname 6 rust-lalrpop 6 rust-lalrpop-util 6 rust-match-cfg 6 rust-quick-xml 6 rust-serde-yaml 6 rust-sharded-slab 6 rust-unicode-segmentation 6 rust-vte 7 rust-camino 7 rust-cfg-if-0.1 7 rust-clap-3 7 rust-colored 7 rust-console 7 rust-ctr 7 rust-encoding 7 rust-encoding-rs 7 rust-foreign-types 7 rust-foreign-types-shared 7 rust-getopts 7 rust-home 7 rust-http-body 7 rust-hyper 7 rust-lazycell 7 rust-memmap 7 rust-object 7 rust-phf 7 rust-phf-shared 7 rust-rustc-demangle 7 rust-syn 7 rust-tar 7 rust-tower 7 rust-tower-service 7 rust-try-lock 7 rust-want 7 rust-zeroize 8 rust-futures-executor 8 rust-httpdate 8 rust-ignore 8 rust-ipnet 8 rust-num-threads 8 rust-siphasher 8 rust-structopt 8 rust-strum 8 rust-thread-local 8 rust-tokio-util 8 rust-yaml 8 rust-yaml-rust 9 rust-cargo 9 rust-cargo-platform 9 rust-clap-complete 9 rust-git2 9 rust-hex 9 rust-libgit2-sys 9 rust-nu-ansi-term 9 rust-openssl-sys 9 rust-subtle 9 rust-uuid 10 rust-ahash 10 rust-ahash-0.7 10 rust-arrayvec 10 rust-bincode 10 rust-fallible-iterator 10 rust-httparse 10 rust-libz-sys 11 rust-filetime 11 rust-is-terminal 11 rust-linked-hash-map 11 rust-openssl-probe 11 rust-rayon 11 rust-rayon-core 11 rust-sha1 12 rust-futures-io 12 rust-open 12 rust-openssl 12 rust-tokio 13 rust-futures-sink 13 rust-globset 13 rust-io-lifetimes 13 rust-lock-api 13 rust-parking-lot 13 rust-parking-lot-core 13 rust-serde-spanned 13 rust-signal-hook 13 rust-signal-hook-registry 13 rust-toml-0.5 13 rust-toml-datetime 13 rust-toml-edit 13 rust-winnow 14 rust-fnv 14 rust-futures-channel 14 rust-http 14 rust-itertools 14 rust-parking 15 rust-futures 15 rust-futures-core 15 rust-futures-task 15 rust-futures-util 16 rust-ar 16 rust-byteorder 16 rust-crossbeam-channel 16 rust-flate2 16 rust-sha2 16 rust-socket2 17 rust-crossbeam-deque 17 rust-crossbeam-epoch 17 rust-mio 17 rust-option-ext 17 rust-ppv-lite86 17 rust-rand-chacha 17 rust-semver 17 rust-tracing 17 rust-tracing-core 18 rust-bstr 18 rust-cpufeatures 18 rust-crc 18 rust-crc32fast 18 rust-env-logger 18 rust-slab 19 rust-adler 19 rust-miniz-oxide 19 rust-vec-map 20 rust-dirs 20 rust-dirs-sys 20 rust-nix 20 rust-tempfile 20 rust-time 20 rust-time-core 20 rust-walkdir 21 rust-block 21 rust-block-buffer 21 rust-bytes 21 rust-chrono 21 rust-crypto-common 21 rust-digest 21 rust-form-urlencoded 21 rust-glob 21 rust-humantime 21 rust-iana-time-zone 21 rust-rand 21 rust-rand-core 21 rust-same-file 21 rust-url 22 rust-base64 22 rust-num-cpus 22 rust-static-assertions 23 rust-clap-2 23 rust-pin-project 23 rust-pin-project-lite 23 rust-pin-utils 24 rust-ansi-term 24 rust-gl 24 rust-idna 24 rust-percent-encoding 24 rust-smawk 24 rust-unicode-linebreak 25 rust-either 25 rust-fastrand 25 rust-unicode-bidi 25 rust-unicode-normalization 26 rust-crossbeam 26 rust-crossbeam-utils 26 rust-generic-array 27 rust-memoffset 27 rust-toml 27 rust-typenum 28 rust-scopeguard 30 rust-terminal-size 32 rust-getrandom 32 rust-termcolor 33 rust-anstream 33 rust-anstyle-parse 33 rust-anstyle-query 33 rust-colorchoice 33 rust-num-traits 33 rust-serde-json 33 rust-textwrap 34 rust-anstyle 34 rust-clap-builder 34 rust-indexmap 34 rust-sc 34 rust-thiserror 34 rust-utf8parse 35 rust-ryu 36 rust-hash 36 rust-hashbrown 37 rust-atty 39 rust-anyhow 39 rust-smallvec 43 rust-linux-raw-sys 43 rust-regex-automata 43 rust-rustix 44 rust-itoa 44 rust-lazy-static 44 rust-unicode-width 46 rust-clap-lex 47 rust-aho-corasick 48 rust-once-cell 49 rust-num 50 rust-regex-syntax 51 rust-regex 52 rust-log 52 rust-serde 56 rust-bitflags-1 56 rust-term 60 rust-strsim 61 rust-memchr 67 rust-clap 68 rust-cfg-if 73 rust-bit 73 rust-bitflags 80 rust-libc
signature.asc
Description: PGP signature
