this post was submitted on 01 Apr 2024
1 points (100.0% liked)

Rust Programming

8011 readers
1 users here now

founded 5 years ago
MODERATORS
nutomic@lemmy.ml
Joe@lemmy.ml
AgreeableLandscape@lemmy.ml
1
cargo-goggles: verify that crates.io releases can be reproduced from the git repository (crates.io)
submitted 5 months ago by PaoloBarbolini@lemmy.ml to c/rust@lemmy.ml
1 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] Vorpal@programming.dev 1 points 5 months ago

Due to the recent xz trouble I presume? Good idea, I was thinking about this on an ecosystem wise scale (e.g. all of crates.io or all of a Linux distro) which is a much harder problem to solve.

Not sure if the tag logic is needed though. I thought cargo embedded the commit ID in the published package?

Also I'm amazed that the name cargo-goggles was available.