4 ms·
> Unless somehow these are compromised at the time of download, I will never have to worry about them again. But this is exactly what rust does x) `cargo add s
by andrepd 10mo ago
> Unless somehow these are compromised at the time of download, I will never have to worry about them again.
But this is exactly what rust does x) `cargo add some_crate` adds a line `crate_name = "1.2.3"` to your project config, downloading and pinning the dependency to that exact version. It will not change unless you specifically change it.
- rcxdude 10mo agowell, not quite. It'll go into the lockfile and you won't get a new version if you just build again, but if you add or remove a dependency that version may shift around a bit as a part of dependency resolution.
- andrepd 10mo agoOnly if that different version is a dependency of a dependency. Your own will never change.
- brabel 10mo agoThat does not make the problem go away: now you'll have both versions in your dependency graph - hence you may be vulnerable to both version's CVEs.
- andrepd 10mo agoAny time you pull any code, be it `cargo add` or `apt install` or copy-pasting it in your own code, you become vulnerable to any issues present in that code. I'm unsure what your point is. The claim is just that `cargo add crate` is functionally identical to downloading a C++ header and keeping it in the same version, since in both cases the dependency will be pinned to that fixed version.
- nateb2022 10mo ago> but if you add or remove a dependency that version may shift around a bit as a part of dependency resolution cargo add crate@version is completely deterministic