Sudo-rs dependencies: when less is better

https://www.memorysafety.org/blog/reducing-dependencies-in-sudo/

by dfern • 2 years ago

7 2 2 years ago

sea-gold• 2 years ago

This was a great (and short) read.

Over the course of a few months we carefully removed almost all of our dependencies, ending up with only three crate dependencies required for the current version. Those crates are libc, glob, and log. All three of them are being maintained under the rust-lang github organization, indicating that they are very much at the core of the Rust ecosystem.

That is impressive!

I also learned about a few other neat things:

- The Tweede golf blog[1] which has lots of great content on Rust (example[2])

- cargo-depgraph[3]

[1] https://tweedegolf.nl/en/blog/

[2] https://tweedegolf.nl/en/blog/104/dealing-with-dependencies-...

[3] https://github.com/jplatte/cargo-depgraph

fbdab103• 2 years ago

I do not write anything as security sensitive as sudo, but I am continually alarmed at the size of a Rust dependency graph. I yearn for someone to package up an annual Rust-standard-library crate as featureful as Python/Go.

Sudo-rs dependencies: when less is better

Related Stories