Making Rust supply chain attacks harder with Cackle

Re:Making Rust supply chain attacks harder with Cackle by paholg on Friday October 13, 2023 @03:27PM (#37874524)

Let's say crate B depends on crate A with a pinned dependency, and uses one of its types in a public interface.

Crate C depends on them both. It now can't bring in updates to A until B does, and when B updates that's a breaking change, so it better bump its major version.

Take a look at this trick, for example, for foundational crates updating their major version: https://github.com/dtolnay/semver-trick

Now imagine that being an issue every single patch update.

[ Parent | on HN ]

Re:Making Rust supply chain attacks harder with Cackle by belinder on Friday October 13, 2023 @04:35PM (#37875321)

Yeah I see what you mean, it's not so much about the first time it's deployed but for future updates where you want to update one dependency but another one requires it to stay the way it is

[ Parent | on HN ]