(as of iirc 1.39) Cargo supports custom registries on stable. That means you can pull your dep to whatever hosting solution you want and leave it. As well, pul

(as of iirc 1.39) Cargo supports custom registries on stable. That means you can pull your dep to whatever hosting solution you want and leave it. As well, pulling from a random server isn't the problem. Trusting a version to be a particular commit is, which crates.io handles as well as Cargo via cargo publish and the lock file. If you pull a dep, the lock file will guarantee that whatever you pull is going to be identical to what was published (assuming you didn't add a git field to the dependencies list or say version = "*"). As for churn in the std or dynamic linking, I've never had an issue using Rust in production and getting reproducible builds otherwise. Same is true for Clang or GCC/stdlib. APIs aren't being changed, binaries may shift, but unless you're on nightly you're probably not going to see anything break - just get better. But you can handle that, just don't update the compiler until you're ready.