4 ms·
It's also worth pointing out that once a version is published to crates.io, it can't be altered, specifically to prevent social engineering attacks. If you're w
by qchris 6y ago
It's also worth pointing out that once a version is published to crates.io, it can't be altered, specifically to prevent social engineering attacks. If you're worried about it, that means you can audit the frozen codebase for any given version from a top-level crate down through the dependencies, and once that trust is established, it can't be leveraged for a silent dependency change later on, which can only happen through a version update on the end-user's side.
- bluGill 6y agoWhat if I audit something down a few levels and find it lacking - how do I force update everything to not use the bad version?
- OJFord 6y agohttps://doc.rust-lang.org/edition-guide/rust-2018/cargo-and-crates-io/replacing-dependencies-with-patch.html https://doc.rust-lang.org/edition-guide/rust-2018/cargo-and-...