tanton_engine: possible public unsound api

[charlesxsh]

The original github repo seems like got deleted, not sure how to create the PR/issue at the upstream project

[djc]

This is the 4th PR you've filed this month (#2262, #2263, #2284). How are you finding these?

Please note the failing CI checks.

[charlesxsh]

This is the 4th PR you've filed this month (#2262, #2263, #2284). How are you finding these?

Please note the failing CI checks.

Thanks for the notifying. I will fix the linting ASAP. I am working on a research project that can automatically find these issues.

[charlesxsh]

Do we have any update/plan on merging these PRs? @djc

[djc]

I sent an email to the maintainer just now, I'm going to wait for 2 weeks before publishing this, per discussion in #1092.

[djc]

Okay, we have approval from the author to publish. I think we want to substantially simplify the advisory, though:

• Drop the long code samples
• Use the functions key to highlight (some of) the unsafe functions you've found
• Provide a high-level description of the issue (like "lack of bound checking")
• Explicitly mention that this crate no longer appears to be maintained