mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
650 stars 43 forks source link

Add --store-path to CLI to specify supply-chain directory. #470

Closed jfgoog closed 1 year ago

jfgoog commented 1 year ago

Our use case for this is the following:

Without the ability to override the path to the supply-chain directory, we would have to fork or patch Config.toml to set [package.metadata.vet].

As a side note, the behavior of cargo vet with respect to the current working directory differs from that of cargo vendor. cargo vendor --manifest-path blah/Cargo.toml uses a vendor directory in the current working directory, while cargo vet init --manifest-path blah/Cargo.toml creates a supply-chain directory in the same directory as the manifest.

jfgoog commented 1 year ago

Thanks for the review and suggestions.