Making Rust supply chain attacks harder with Cackle

Re:Making Rust supply chain attacks harder with Cackle by belinder on Friday October 13, 2023 @01:58PM (#37873511)

Wouldn't the library dependency hierarchy have been figured out during development in order to get it to a state that can compile? I'm assuming if you're pinning a dependency you already have something that compiles

[ Parent | on HN ]

Re:Making Rust supply chain attacks harder with Cackle by paholg on Friday October 13, 2023 @03:27PM (#37874524)

Let's say crate B depends on crate A with a pinned dependency, and uses one of its types in a public interface.

Crate C depends on them both. It now can't bring in updates to A until B does, and when B updates that's a breaking change, so it better bump its major version.

Take a look at this trick, for example, for foundational crates updating their major version: https://github.com/dtolnay/semver-trick

Now imagine that being an issue every single patch update.

[ Parent | on HN ]

Re:Making Rust supply chain attacks harder with Cackle by belinder on Friday October 13, 2023 @04:35PM (#37875321)

Yeah I see what you mean, it's not so much about the first time it's deployed but for future updates where you want to update one dependency but another one requires it to stay the way it is

[ Parent | on HN ]