praseodym
Joined 13 years ago
Karma
2,533
Submissions
501
Member since
Jun 18
Joined 13 years ago
See https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.h...
pnpm does have some other features to prevent supply chain attacks, so there is still something to learn from other ecosystems. For example pnpm has a cooldown period for new dependencies and can prevent trust policy downgrades (eg new version published without build provenance where older versions did have it). See https://pnpm.io/supply-chain-security
Discussion: https://news.ycombinator.com/item?id=49372853
There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681