4 ms·
Mozilla, Google and a couple of others are publishing their audits through cargo vet. There are also additional audits done by individuals you can use through c
by weinzierl 2mo ago
Mozilla, Google and a couple of others are publishing their audits through cargo vet. There are also additional audits done by individuals you can use through cargo crev. Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates.
In the end it is your decision to use unaudited or refuse unaudited crates.
- Panzerschrek 2mo ago> In the end it is your decision to use unaudited or refuse unaudited crates. It should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.
- weinzierl 2mo agoIf you want that you can always use vetted package repositories like Nexus. Many companies do.