search

M4SS-Code / cargo-goggles

Verify that registry crates in your Cargo.lock are reproducible from the git repository
https://crates.io/crates/cargo-goggles
Apache License 2.0
36 stars 2 forks source link

Lockfile for non-reproducible crates #16

Open link2xt opened 3 months ago

link2xt commented 3 months ago

cargo-goggles needs a way to store a list of tested reproducible and tested non-reproducible crates next to Cargo.lock so it can be committed to the repository. Then in CI we can check that all packages from Cargo.lock have been tested and are included in one of these lists. Locally developers can run cargo-goggles to update the list, but likely not in CI on every commit because downloading git repositories for all dependencies is too slow and uses git hoster resources unnecessarily.

link2xt commented 3 months ago

Maybe this overlaps with https://github.com/mozilla/cargo-vet Essentially I want to have for each dependency a record saying some developer has checked that it is reproducible, or not reproducible but the differences are not important (Cargo.toml formatting etc.) and an issue has been filed.

paolobarbolini commented 3 months ago

Then in CI we can check that all packages from Cargo.lock have been tested and are included in one of these lists.

I'm not sure this really stands on the security side. What's stopping someone from sending a PR with all of the newly added dependencies marked as perfectly reproducible only to find out the file had been changed by hand?

link2xt commented 3 months ago

Ok, maybe a list of known reproducible crates is not that useful and we can run not on every commit but when Cargo.lock changes, that it is manageable.

Feature request then is to create a cargo-goggles.lock file with a list of known non-reproducible crates on a first run. Then on rerun remove crates that are not in Cargo.lock anymore and complain if more non-reproducible crates are added to prevent upgrades from reproducible crates to non-reproducible.