undefined | Better HN

0 pointsyakubin4y ago0 comments

> As for Cargo, [...] I also found it unusable because it provided no way to check for the hash or signature of the dependencies that it downloads.

Afaik Cargo does it out of the box, based on Cargo.lock.

UPDATE: This doc page seems to confirm that: <https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lo...>

0 comments

h_anna_h4y ago

I did not know about rev, thanks. Though, since there is no way to specify a signature you are forced to use potentially outdated packages.

yakubinOP4y ago

"cargo update" will update the packages along with Cargo.lock content. As for not updating them without a manual trigger, I consider it a feature, but I guess it's a matter of opinion.

h_anna_h4y ago

> "cargo update" will update the packages along with Cargo.lock content

Disregarding the rev attribute?

1 more reply

j / k navigate · click thread line to collapse

0 pointsyakubin4y ago0 comments

> As for Cargo, [...] I also found it unusable because it provided no way to check for the hash or signature of the dependencies that it downloads.

Afaik Cargo does it out of the box, based on Cargo.lock.

UPDATE: This doc page seems to confirm that: <https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lo...>

0 comments

h_anna_h4y ago

I did not know about rev, thanks. Though, since there is no way to specify a signature you are forced to use potentially outdated packages.

yakubinOP4y ago

"cargo update" will update the packages along with Cargo.lock content. As for not updating them without a manual trigger, I consider it a feature, but I guess it's a matter of opinion.

h_anna_h4y ago

> "cargo update" will update the packages along with Cargo.lock content

Disregarding the rev attribute?

1 more reply

j / k navigate · click thread line to collapse