“Dude, Where's My C?"
summary
Painter is a graph-backed pipeline that builds every crate on GCP on every publish using a three-build pipeline (full LTO, unoptimized, LLVM IR) to extract function-level call graphs and monitor build.rs executions and linker commands. Analysis finds about 20% of crates contain unsafe syntax but flags are only indicators; actual external C linkage concentrates in 85% crypto and compression libraries. Painter also powers Sand Pit for malicious-crate analysis and detects vendored objects, semver mismatches, and dynamically linked non-Rust functions.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:52Unsafe code boundaries
- 4:01Unsafe code analysis
- 7:24Painter for ecosystem
- 11:49Detecting C libraries
- 14:56C library linkage results
- 16:29Semver mismatches
- 22:51Future Rust interop
- 24:49Call to action
related talks
18mAuditing Rust Crates Effectively
59mRust for C++ developers - What you need to know to get rolling with crates
50mCrate security in 2025
01h 01mClosing the Gap between Rust and C++ Using Principles of Static Analysis
45mBuilding Safe and Secure Systems in Rust
19mCounterexamples in Safe Rust
32mBuilding and Maintaining Rust at Scale
22mRust as a Foundation for a Safe and Sustainable Future