Should we file advisories on Rustc bins

[pinkforest]

Following up from in favor of initial discussion here:

• Create advisory for Rust miscomilation bug which affects aes-soft #152
• Add CVE-2021-42574 on rustc #1094
• CVE-2019-16760 does not disambiguate between the cargo lib and the cargo bin #1111 (cargo specific)

We can deal with those issues if we decide to support advisories on Rustc.

First though I think we need to have a wider discussion around this

I know we have advisories against std and cargo but they interface the Rust code people write.

My personal opinion is that RustSec is only for the ecosystem and it would be quite bit of scope creep.

[tarcieri]

We do deal with advisories against rustc:

https://github.com/rustsec/advisory-db/tree/main/rust

...however these are generally just syndicating vulnerabilities published by the core team.

They aren't surfaced by any CLI tooling like cargo-audit, however they do get published to https://rustsec.org, e.g.

https://rustsec.org/advisories/CVE-2015-20001.html

[pinkforest]

Yes.. however there is no directory yet for rustc.. only cargo, rustdoc and std so far :/

If we were to file advisories against rustc wouldn't it make sense to cargo audit be opinionated about rustup show ?