Vetting the cargo [LWN.net]

Vetting the cargo

Posted Jun 16, 2022 15:38 UTC (Thu) by mathstuf (subscriber, #69389)
In reply to: Vetting the cargo by jcpunk
Parent article: Vetting the cargo

For anything with this kind of auditing, I suspect `Cargo.lock` is versioned alongside it. This records the name, version, and hash of its `.crate` used.

to post comments

Vetting the cargo

Posted Jun 16, 2022 16:17 UTC (Thu) by excors (subscriber, #95769) [Link]

As far as I can see, you're not expected to publish Cargo.lock alongside your audits. Importing is done by just giving the URL of audits.toml and there's no general way to find a Cargo.lock from that.

From the discussion in https://github.com/mozilla/cargo-vet/issues/79 , it sounds like they considered storing the crate's checksum alongside the version in the audit file, and then decided not to because it didn't seem to protect against any plausible attacks. Instead you have to trust that crates.io has not been compromised and is not serving different code for the same crate version to different users, or that if it was then someone would very quickly notice checksum failures with all the other cargo commands that use Cargo.lock.