!FBuJyWXTGcGtHTPphC:nixos.org

Nix Rust

671 Members
Rust154 Servers

Load older messages


SenderMessageTime
24 Nov 2025
@rosssmyth:matrix.orgrosssmyth* That's basically yanked packages, which that prototype tool already filters out automatically. But unfortunately yanked packages cannot be relied on for security. 17:34:48
@rosssmyth:matrix.orgrosssmythSince it could be an unmaintained package, so the author would not yanked it17:35:13
@rosssmyth:matrix.orgrosssmyth* Since it could be an unmaintained package, so the author would not yank it17:35:17
@rosssmyth:matrix.orgrosssmythI have another PR up that if combined with yanked package elimiation would catch CVEs https://github.com/NixOS/nixpkgs/pull/45888117:36:16
@rosssmyth:matrix.orgrosssmyth* I have another PR up that would catch CVEs https://github.com/NixOS/nixpkgs/pull/45888117:36:25
@niklaskorz:matrix.orgniklaskorzoh that's amazing!18:16:46
25 Nov 2025
@weethet:catgirl.cloudWeetHet

Why not do it like this and collect them using nix?

use rayon::iter::ParallelIterator;

#[allow(dead_code)]
#[derive(serde::Serialize)]
struct CrateJson {
    name: String,
    version: String,
    checksum: [u8; 32],
    deps: Vec<String>,
}

fn main() {
    let index = crates_index::GitIndex::with_path("../index", crates_index::git::URL).unwrap();

    println!("Processing crates...");
    index
        .crates_parallel()
        .filter_map(|c| c.ok())
        .for_each(|c| {
            println!("Processing crate: {}", c.name());

            let name = c.name();
            let versions = c.versions();

            let mut major_versions: std::collections::HashMap<u64, Vec<&crates_index::Version>> =
                std::collections::HashMap::new();

            for v in versions {
                if let Ok(semver) = semver::Version::parse(v.version()) {
                    if semver.major == 0 {
                        let key = semver.minor + 1000000;
                        major_versions.entry(key).or_default().push(v);
                    } else {
                        major_versions.entry(semver.major).or_default().push(v);
                    }
                }
            }

            for (_, mut group) in major_versions {
                group.sort_by(|a, b| {
                    let va = semver::Version::parse(a.version()).unwrap();
                    let vb = semver::Version::parse(b.version()).unwrap();
                    vb.cmp(&va)
                });

                if let Some(latest) = group.first() {
                    let semver = semver::Version::parse(latest.version()).unwrap();
                    let major_ver = if semver.major == 0 { 0 } else { semver.major };

                    let prefix = if name.len() >= 2 { &name[..2] } else { name };

                    let dir_path = format!("rust-crates/by-name/{}/{}", prefix, name);
                    std::fs::create_dir_all(&dir_path).unwrap();

                    let file_path = format!("{}/v{}.json", dir_path, major_ver);

                    let crate_json = CrateJson {
                        name: name.to_string(),
                        version: latest.version().to_string(),
                        checksum: *latest.checksum(),
                        deps: latest
                            .dependencies()
                            .iter()
                            .map(|d| d.name().to_string())
                            .collect(),
                    };

                    let json = serde_json::to_string(&crate_json).unwrap();
                    std::fs::write(&file_path, json).unwrap();
                }
            }
        });
}
14:10:21
@acidbong:envs.netAcid Bongjust realized I'm running Hacksaw with xcb-0.9, which contains a CVE 💀 i hope bumping it to 1.6 won't break anything14:13:02
@rosssmyth:matrix.orgrosssmythYes of course there is more processing to do. This was just an idea I had and I wanted to see how large the JSON file would actually be. This doesn't actually change anything. 19:05:27
@rosssmyth:matrix.orgrosssmyth* Yes of course there is more processing to do. This was just an idea I had and I wanted to see how large the JSON file would actually be. This doesn't actually fix anything. 19:12:04
@weethet:catgirl.cloudWeetHetThis should help with merge conflicts I think, no?19:56:20
@rosssmyth:matrix.orgrosssmythThe idea of processing all the crates into one file is to eliminate merge conflicts from being possible in the first place19:58:38
@rosssmyth:matrix.orgrosssmythSince the maintainer(s) of the package set would just regenerate the entire file every week or so 19:59:03
@rosssmyth:matrix.orgrosssmyth

Another idea I have been ruminating upon is something like:

  1. Create a package set like rustCrates, but do not populate it with anything initially
  2. Create builders similar to the above idea (add the source, add a symlink builder for cargo-vendor)
  3. When someone wants to add a Rust package, a new process is used:
    1. Use a tool that processes lock files, and checks if the required crates are in the package set
    2. If not, it emits the latest semver-compatible to a by-name-like directory tree using the crates.to name
  4. Each ~week a program similar to the one I made is ran:
    1. For each crate in the package set, update each semver to the latest-compatible one, should be relatively fast since no downloading is required, the version is in the index, and the required hash is in the index
    2. Write the latest semver-compatible-version and hash in the files
    3. Check the rustsec db as well, and if crates are yanked.
  5. For program dependencies in which the semver that is required is already in the pkgset, they do not touch the package set. If they need to wait a ~week for the next version to the bumped to that is fine.
20:09:31
@weethet:catgirl.cloudWeetHet Yeah that's basically what I wanted to achieve with my script 21:07:07
28 Nov 2025
@anniecrudeness:matrix.organniecrudeness joined the room.18:06:53
29 Nov 2025
@amadaluzia:unredacted.orgamadaluzia changed their profile picture.11:40:45
30 Nov 2025
@akompella:matrix.orgAditya Kompella joined the room.22:49:08
1 Dec 2025
@akompella:matrix.orgAditya KompellaHello. I've been using nix and nixos for a while. I noticed that in the changelog for the new stable release that there was a few rust projects. How can I get involved as a newcomer, with some decent rust and nix experience?01:16:38
@acidbong:envs.netAcid Bong
In reply to @akompella:matrix.org
Hello. I've been using nix and nixos for a while. I noticed that in the changelog for the new stable release that there was a few rust projects. How can I get involved as a newcomer, with some decent rust and nix experience?
everyone can submit their fixes to Nixpkgs. if you wanna take responsibility for specific packages/modules, add yourself to their maintainers (see readmes under maintainers and pkgs on how)
04:47:35
@akompella:matrix.orgAditya KompellaThank you. I am planning currently to submit a PR to nixpkgs for a package I haven't seen on there, and I'll take a look at taking responsibility for other packages once I go through the process once myself, I hadn't considered that. However, I was asking more about the nix / nixos tooling / projects rather than projects in nixpkgs.08:34:44
@k900:0upti.meK900 Nixos tooling that is Rust mostly lives inside nixpkgs 09:03:53
@k900:0upti.meK900 Nix itself doesn't use Rust 09:03:58
@k900:0upti.meK900 Lix, a Nix fork, uses Rust somewhat, and plans for more Rust in the future 09:04:10
@Ericson2314:matrix.orgJohn EricsonSee also the recent activity in https://github.com/nix-community/harmonia09:06:34
@Ericson2314:matrix.orgJohn EricsonAn all-Rust daemon should not be much more work away09:07:03
3 Dec 2025
@glepage:matrix.orgGaétan Lepage I have set cargoCheckType = "debug" and the env variable still shows "release". Are we supposed to set it as an env variable?
I saw some derivations that set cargoCheckType in their attrs...
18:07:18
@rosssmyth:matrix.orgrosssmyth Should work unless you are using buildRustPackage then you need to set checkType and not cargoCheckType 18:15:44
@neobrain:matrix.orgneobrain joined the room.21:27:05
@neobrain:matrix.orgneobrainWhen writing a flake.nix for a Rust project I'm authoring (i.e. it'll bundle the flake), are there reasons to use anything other than nixpkgs's buildRustPackage?22:20:37

Show newer messages


Back to Room ListRoom Version: 6