I've compared nearly all Rust crates.io crates to contents of their Git repos
1–10 of 65 posts
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#2Good initiative. Now people need to go through this and do the reviews :-)
Next step would be to do reproducible builds (if it's not already the case).
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#3Good initiative. Now people need to go through this and do the reviews :-) Next step would be to do reproducible builds (if it's not already the case).
First pass gpt?
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#4Good initiative. Now people need to go through this and do the reviews :-) Next step would be to do reproducible builds (if it's not already the case).
Not a Rust dev so maybe a dumb question, but is this more involved than just running diffs? If so, what needs to be done?
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#5Good initiative. Now people need to go through this and do the reviews :-) Next step would be to do reproducible builds (if it's not already the case).
Not a Rust dev so maybe a dumb question, but is this more involved than just running diffs? If so, what needs to be done?
The key thing is interpretation of the diff. Is there a difference since they ran some code generator ins the crate contains generated code, not present in the repo or did they add a backdoor?
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#6How could you rank them for review priority? Use a combination of repo popularity multiplied by amount of significant differences? Where significant differences are determined by excluding non-code files?
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#7Deterministic compilation is the best way to let people validate what they are downloading from repositories is what is in the codebases.
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#8How crazy would it be to have a package repository that also builds the artifacts it distributes? You’d need a high barrier to entry to save on costs and time sifting through garbage. Perhaps it’s this high barrier that would prevent such a repository from taking off though. Perhaps this is just a really dumb step on a path leading back to simple checksum validations… though with those, you’re only validating that whatever was uploaded is what you downloaded, it doesn’t ensure that it was built from a known set of source files… hard problems.
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#9How crazy would it be to have a package repository that also builds the artifacts it distributes? You’d need a high barrier to entry to save on costs and time sifting through garbage. Perhaps it’s this high barrier that would prevent such a repository from taking off though. Perhaps this is just a really dumb step on a path leading back to simple checksum validations… though with those, you’re only validating that wh…
Isn't this gentoo?
Re: I've compared nearly all Rust crates.io crates to contents of their Git repos
#10Deterministic compilation is the best way to let people validate what they are downloading from repositories is what is in the codebases.
> Deterministic compilation is the best way to let people validate what they are downloading from repositories is what is in the codebases.
"the best way"? Please make the argument for why. To do it properly, you must steel-man the alternatives (not shoot down straw-men)