Make it easier to audit upgrades by diffing .crate files
#7020
epage
started this conversation in
Feature Requests
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Recent supply-chain discussions had me thinking it could be helpful to see the differences in the published
.cratefile. There is currently a third-party tool for this but figured having it built directly in would raise awareness and make it easier to use.A bonus is an idea I posted on the diff.rs issue tracker which is diffing across crates. This would help when looking at potential forks or supply chain attacks to figure out what was actually done (e.g. I just recently found
clap_builder_cryowhich didn't change the repository links, making it harder to figure out what was going on.Beta Was this translation helpful? Give feedback.
All reactions