embarkstudios / presser Goto Github PK

It would be great to be able to use these and would help with not violating miri's implementation of stacked borrows by allowing us to not narrow the borrow until needed. But, rust-lang/rust#71146 is needed before this is possible.

We should add a self-audit of this crate to our central audit file in https://github.com/EmbarkStudios/rust-ecosystem/blob/main/audits.toml.

Practically all that is needed is doing a PR to that repo that adds a toml item for the latest version of presser, would be nice in the notes of the audit to describe a bit around the unsafe code in this crate, that there are no ambient capabilities or dependencies, and can say that we are using it in production. Can be quite brief though!

See this section about what to think about for the audit: https://mozilla.github.io/cargo-vet/built-in-criteria.html#safe-to-deploy

Self-audit/certification is fine (see cargo-vet book), but it would be wonderful if we could later also find someone external to audit it also.

Related to #1, but likely to come after. Requires https://doc.rust-lang.org/std/mem/union.MaybeUninit.html#method.slice_assume_init_ref and some other MaybeUninit methods to become stable to be practical.