Augmenting as a code review tool

[tmpfs]

With the recent spate of supply chain attacks and that they will inevitably reach the Rust ecosystem I was researching a tool to audit build.rs files, a prototype is here.

Some discussion on this thread mentioned diff.rs which I think would be a great starting point for a review tool and just wanted to gauge whether you had any interest in adding a code review mode possibly behind feature flags?

[xfbs]

Hey @tmpfs, honestly this is a great idea. And your prototype is very neat! I feel like that is something I would actually use.

I have had a similar idea, but approaching it from a different angle. I wanted to build a more complex version of that, basically an "auditing" platform that pulls in information about crates (exatracted from crates.io database dumps). Allows you to create an account and do audits, audits are signed (with you SSH key) so the platform doesn't need to be trusted. And then some way to configure Cargo to only be able to resolve dependencies which have been audited. Kind of like a backend for cargo-vet.