From a memory-safety audit of nobilis on 2 October 2026: its own code has two unsafe blocks (both sound libc calls in main.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in Cargo.lock, and each one traced to whether it is actually compiled in.
arti is built with its compression feature (Cargo.toml), which decompresses directory documents from Tor relays with zstd and xz - both C (zstd-sys 1.5.7, liblzma-sys). That data comes from the Tor network, not from a party moho trusts.
Both are mature and heavily fuzzed, and the documents are signed - but signatures are checked after decompression, so the decompressor sees unauthenticated input. Options:
drop the compression feature: directories download uncompressed (more bandwidth on a cold bootstrap, nothing else), and two C libraries leave the build;
or keep it and track both libraries' versions.
Related, while there: the build carries two crypto providers, ring (rustls, nobilis) and aws-lc-rs (pulled in through arti's rustls) - both partly C and assembly. Settling on one halves that surface.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two `unsafe` blocks (both sound libc calls in `main.rs`), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in `Cargo.lock`, and each one traced to whether it is actually compiled in.
arti is built with its `compression` feature (`Cargo.toml`), which decompresses directory documents from Tor relays with **zstd** and **xz** - both C (`zstd-sys` 1.5.7, `liblzma-sys`). That data comes from the Tor network, not from a party moho trusts.
Both are mature and heavily fuzzed, and the documents are signed - but signatures are checked after decompression, so the decompressor sees unauthenticated input. Options:
- drop the `compression` feature: directories download uncompressed (more bandwidth on a cold bootstrap, nothing else), and two C libraries leave the build;
- or keep it and track both libraries' versions.
Related, while there: the build carries two crypto providers, `ring` (rustls, nobilis) and `aws-lc-rs` (pulled in through arti's rustls) - both partly C and assembly. Settling on one halves that surface.
Salastil
added this to the v1.0 milestone 2026-10-02 19:03:40 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two
unsafeblocks (both sound libc calls inmain.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate inCargo.lock, and each one traced to whether it is actually compiled in.arti is built with its
compressionfeature (Cargo.toml), which decompresses directory documents from Tor relays with zstd and xz - both C (zstd-sys1.5.7,liblzma-sys). That data comes from the Tor network, not from a party moho trusts.Both are mature and heavily fuzzed, and the documents are signed - but signatures are checked after decompression, so the decompressor sees unauthenticated input. Options:
compressionfeature: directories download uncompressed (more bandwidth on a cold bootstrap, nothing else), and two C libraries leave the build;Related, while there: the build carries two crypto providers,
ring(rustls, nobilis) andaws-lc-rs(pulled in through arti's rustls) - both partly C and assembly. Settling on one halves that surface.