cargo-geiger unsafe-code audit (all workspace crates)
Ran cargo-geiger across the whole
workspace to quantify unsafe usage in the crates and their dependency trees. Sharing
the results in case they're useful for auditing / dependency hygiene.
cargo-geiger is an auditing aid (where to focus a manual review), not a security
verdict — unsafe is frequently necessary and correct.
Tooling: cargo-geiger 0.13.0, cargo 1.94.0, --all-features, run per workspace
member (virtual manifest can't be scanned with --workspace).
Metric format: x/y — x = unsafe used by the build, y = total unsafe found.
Symbols: :) forbids unsafe · ? no unsafe (not forbidden) · ! uses unsafe.
Per-crate dependency tree (deduped crate counts)
| Package |
Deps in tree |
Uses unsafe ! |
No unsafe ? |
Forbids unsafe :) |
| libmwemu |
212 |
115 |
81 |
16 |
| mwemu |
219 |
118 |
84 |
17 |
| mwemu-mcp |
217 |
124 |
75 |
18 |
| mwemu-test |
215 |
118 |
81 |
16 |
| pymwemu |
258 |
139 |
94 |
25 |
Workspace crates' OWN unsafe (expressions used/total)
| Crate |
Own unsafe |
Notes |
| libmwemu |
74/74 |
core emulator (mem/ptr casts) |
| mwemu-mcp |
3/3 |
|
| mwemu |
0/0 |
CLI |
| mwemu-test |
0/0 |
|
| pymwemu |
0/0 |
unsafe arrives via pyo3 |
libmwemu totals (used/total)
Functions Expressions Impls Traits Methods
498/1256 39575/57344 620/724 82/85 799/1135
Biggest unsafe contributors in the tree (by used unsafe expressions)
| Crate |
Expr used/total |
Source |
| unsafe-libyaml 0.2.11 |
14491/14963 |
via serde_yaml |
| pyo3 0.26.0 |
3079/3319 |
pymwemu only |
| iced-x86 1.21.0 |
2433/2516 |
x86 disassembler (core dep) |
| memchr 2.7.4 |
1700/2421 |
transitive |
| ndarray 0.16.1 |
1470/1638 |
|
| hashbrown 0.17.1 |
1348/1612 |
|
| rustix 1.1.2 |
1342/7503 |
|
| pyo3-ffi 0.26.0 |
1218/1218 |
pymwemu only |
| aho-corasick 1.1.3 |
997/997 |
|
| parking_lot_core |
967/1320 |
|
| bitvec 1.0.1 |
954/1169 |
|
Notes / possible follow-ups
- The single largest unsafe contributor is
unsafe-libyaml (pulled in via serde_yaml).
If YAML handling is non-critical, an alternative parser would remove ~14.5k unsafe
expressions from the tree.
iced-x86 is unavoidable and central to the project.- Reproduce per crate:
cargo geiger --manifest-path crates/<crate>/Cargo.toml --all-features
Happy to open a PR adding a docs/geiger/ report + a Makefile target to regenerate this
if that's of interest.
cargo-geigerunsafe-code audit (all workspace crates)Ran
cargo-geigeracross the wholeworkspace to quantify
unsafeusage in the crates and their dependency trees. Sharingthe results in case they're useful for auditing / dependency hygiene.
Tooling:
cargo-geiger 0.13.0,cargo 1.94.0,--all-features, run per workspacemember (virtual manifest can't be scanned with
--workspace).Metric format:
x/y—x= unsafe used by the build,y= total unsafe found.Symbols:
:)forbids unsafe ·?no unsafe (not forbidden) ·!uses unsafe.Per-crate dependency tree (deduped crate counts)
!?:)Workspace crates' OWN unsafe (expressions used/total)
libmwemu totals (used/total)
Biggest unsafe contributors in the tree (by used unsafe expressions)
serde_yamlNotes / possible follow-ups
unsafe-libyaml(pulled in viaserde_yaml).If YAML handling is non-critical, an alternative parser would remove ~14.5k unsafe
expressions from the tree.
iced-x86is unavoidable and central to the project.cargo geiger --manifest-path crates/<crate>/Cargo.toml --all-featuresHappy to open a PR adding a
docs/geiger/report + a Makefile target to regenerate thisif that's of interest.