cli/README Zero Trust : review source #211

modalala commented 2026年04月29日 03:19:59 +02:00

This is a tracking issue.

Following quickstart docs:

(https://docs.caution.co/quickstart/ > https://docs.caution.co/quickstart/fully-managed/#install-the-cli > https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md)

Section Zero Trust

2. Review source
Ideal: Review the entire supply chain for high risk uses

Most of these notes I gathered when I first cloned the repo and examined it, approaching it "as a developer."

• Containerfiles: I noticed that StageX images being used are stale. That example resolves to this image which is ~ 7 months old. This was before the StageX LLVM updates to bootstrap Rust, so we may want to update some or all of the Containerfiles.
• Rust dependencies: Overall a good looking and relatively minimal set, but the project uses 872 compilation units. Some possible improvements with ...
  dirs crate (project is at 5, 6.0.0 available)
  consider using time instead of chrono (time is "fully interoperable with the standard library. Mostly compatible with #![no_std] "). chrono can handle some things time cannot, seemingly around time zone issues and comparisons between different zone. See this link for discussion of limitations, tradeoffs and possible shims.
  dotenvy is ~3 years old. There is no update on crates.io but 0.16 (unreleased) is active on GitHub.
  subtle 2.5 is behind stable 2.6.1 (2.5 is ~3 years old, and version 2.6 was yanked!)
  hmac = "0.12" is behind existing 0.13 and sha2 at 0.10 is behind 0.11
  rand is 0.8. - 0.10 rand exists and is an update, but it is 'fatter' in terms of both LoC and dependencies. See this link, which talks about the changes from 0.8 to 0.9.
• Rust has numerous warnings during check and compilation.
• Rust has one failing test: test_rejects_domain_with_invalid_characters - this looks on the surface to be not a failure to throw an error, but just having the error be of the correct type.

This is a tracking issue. ### Following quickstart docs: (https://docs.caution.co/quickstart/ > https://docs.caution.co/quickstart/fully-managed/#install-the-cli > https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md) Section [Zero Trust](https://codeberg.org/caution/platform/src/branch/main/src/cli/README.md#zero-trust) > **2. Review source** > Ideal: Review the entire supply chain for high risk uses Most of these notes I gathered when I first cloned the repo and examined it, approaching it "as a developer." - Containerfiles: I noticed that [StageX images being used are stale](https://codeberg.org/caution/platform/src/commit/160a495c0e2fe56d4eb71b8d2db8291e98cfa675/containerfiles/Containerfile.cli#L3). That example resolves to [this image](https://hub.docker.com/layers/stagex/pallet-rust/sx2025.10.0/images/sha256-9c38bf1066dd9ad1b6a6b584974dd798c2bf798985bf82e58024fbe0515592ca) which is ~ 7 months old. This was before the StageX LLVM updates to bootstrap Rust, so we may want to update some or all of the Containerfiles. - Rust dependencies: Overall a good looking and relatively minimal set, but the project uses 872 compilation units. Some possible improvements with ... `dirs` crate (project is at 5, 6.0.0 available) consider using `time` instead of `chrono` (`time` is "fully interoperable with the standard library. Mostly compatible with `#![no_std]` "). `chrono` can handle some things `time` cannot, seemingly around time zone issues and comparisons between different zone. See [this link](https://docs.rs/jiff/latest/jiff/_documentation/comparison/index.html#time-zone-database-integration-1) for discussion of limitations, tradeoffs and possible shims. `dotenvy` is ~3 years old. There is no update on `crates.io` but 0.16 (unreleased) [is active on GitHub](https://github.com/allan2/dotenvy). `subtle` 2.5 is behind stable 2.6.1 (2.5 is ~3 years old, and version 2.6 was yanked!) `hmac = "0.12"` is behind existing 0.13 and `sha2` at 0.10 is behind 0.11 `rand` is 0.8. - 0.10 rand exists and is an update, but it is 'fatter' in terms of both LoC and dependencies. See [this link](https://lucumr.pocoo.org/2025/2/4/fat-rand/), which talks about the changes from 0.8 to 0.9. - Rust has numerous warnings during check and compilation. - Rust has one failing test: `test_rejects_domain_with_invalid_characters` - this looks on the surface to be not a failure to throw an error, but just having the error be of the correct type.