4 ms·
Cargo uses lockfiles by default to pin all dependencies of an application, so reproducibility shouldn't be much of an issue.
by AgentME 6y ago
Cargo uses lockfiles by default to pin all dependencies of an application, so reproducibility shouldn't be much of an issue.
- hedora 6y agoNo one reads lockfiles. In python, people have successfully backdoored projects by sending a PR that upgrades a dependency and regenerates the lockfiles. Somewhere in the 1MB lockfile patch, they pin a dependency to a version with a known remotely exploitable flaw (sometimes a zero day, sometimes not).