2 ms·
The whole problem is that binaries are in the regular source distribution unfortunately with no way to turn off their usage.
by monocasa 3y ago
The whole problem is that binaries are in the regular source distribution unfortunately with no way to turn off their usage.
- fnordpiglet 3y agoYes thanks as I read the issue and the code I realized the advice was to patch downstream. I know a lot of folks who build hermetic and reproducible builds for large amounts of open source code often have to patch downstream, but its fairly rare to see that requirement from such a basic crate/library. Hopefully this resolved at some point, it seems like a pretty aggressive stance to take that puts people who have a hard job (rigorous chain of trust in builds is hard work and done for very good reasons!!) in a harder spot.