Re:Making Rust supply chain attacks harder with Cackle
by epage on Friday October 13, 2023 @06:08PM
(#37876149)
In cargo (Rust's primary build tool), there are two ways to pin dependencies:
- `Cargo.lock`: handled implicitly so long as you check it in which, as of rust 1.74 (next release), `cargo new` will scaffold all projects this way by default.
- `Cargo.lock`: handled implicitly so long as you check it in which, as of rust 1.74 (next release), `cargo new` will scaffold all projects this way by default.
- `Cargo.toml`: requires using a `=` version requirement. We generally recommend against pinning this way; see https://doc.rust-lang.org/cargo/reference/specifying-depende...