tanton_engine: possible public unsound api

[charlesxsh]

The original github repo seems like got deleted, not sure how to create the PR/issue at the upstream project

[djc]

This is the 4th PR you've filed this month (#2262, #2263, #2284). How are you finding these?

Please note the failing CI checks.

[charlesxsh]

This is the 4th PR you've filed this month (#2262, #2263, #2284). How are you finding these?

Please note the failing CI checks.

Thanks for the notifying. I will fix the linting ASAP. I am working on a research project that can automatically find these issues.

[charlesxsh]

Do we have any update/plan on merging these PRs? @djc

[djc]

I sent an email to the maintainer just now, I'm going to wait for 2 weeks before publishing this, per discussion in #1092.

[djc]

Okay, we have approval from the author to publish. I think we want to substantially simplify the advisory, though:

• Drop the long code samples
• Use the functions key to highlight (some of) the unsafe functions you've found
• Provide a high-level description of the issue (like "lack of bound checking")
• Explicitly mention that this crate no longer appears to be maintained

[charlesxsh]

Okay, we have approval from the author to publish. I think we want to substantially simplify the advisory, though:

• Drop the long code samples
• Use the functions key to highlight (some of) the unsafe functions you've found
• Provide a high-level description of the issue (like "lack of bound checking")
• Explicitly mention that this crate no longer appears to be maintained

I updated, let me know if the updated version is ok.

[djc]

I cleaned up the advisory for you. Please apply similar changes to your other PRs.

[djc]

Changed the version to only match the single current version, which is presumably the only one you've checked.

[djc]

Removed the use of Possible in the title, removed the crate name since it's already in the metadata and gets used in lots of places.

[djc]

Turned affected functions into a bullet list, used :: instead of . as is idiomatic in Rust and added () suffix to make it obvious that these are functions.