4 ms·
Wait a second, I need to understand this better. If you cargo build, can that run a dependencies' build including trying to compile C and stuff?
by oblio 3y ago
Wait a second, I need to understand this better.
If you cargo build, can that run a dependencies' build including trying to compile C and stuff?
- oefrha 3y agoYes, see https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html.
- bogeholm 3y agoI believe build.rs can do pretty much anything: https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html
- oblio 3y agoThat's both scary and sad :-(
- winstonewert 3y agoWhy? If you are using a crate, its code will be running in your application. Its not really any more of a concern if it can run code while building.
- oblio 3y agoYeah, but with binary packages you can add another lay of defense in depth, signed packages, signature checking, etc. It's not just about the original authors themselves, it can also be about attacks on the public repositories, for example.