4 ms·

I mirror all deps locally and only build from the mirror. It isn’t an issue. C/C++ is my dayjob

• procaryote 1y ago
  at some point you could mirror a supply chain attack... xz was a pretty long game and only found by accident for example
  • dgfitz 1y ago
    I’m sure I will.
• josephg 1y ago
  This runs the risk of shipping C/C++ libraries with known vulnerabilities. How do you keep track of that? At least with npm / cargo / etc, updating dependencies is a single command away.
  • dgfitz 1y ago
    Pull, update, build?
    • josephg 1y ago
      How do you even know a dependency has an open vulnerability?
      • dgfitz 1y ago
        Conversely, how do you know when a dependency doesn’t have a vulnerability?