Recent searches
Search options
@puppygirlhornypost@transfem.social @hipsterelectron Not a tool to automatically traverse package dep trees (we have those, no?) but to evaluate an individual library for things like thread unsafe init/exit code, sketchy dynamic code mechanisms, ctors with side effects, etc - things that might make your program vulnerable to bugs or backdoors just by linking the lib even if you don't call it.
@dalias @puppygirlhornypost iirc @spack was doing binary analysis largely for computing package compatibility but could also be applied to this sort of security checking. we already e.g. set RPATHs so output libs point to the correct location of dependencies from the spack dep graph, this sort of auditing seems vaguely similar