search

mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Publish pre-built binaries of cargo-vet #484

Closed repi closed 3 months ago

repi commented 1 year ago

While this tool is still in development, I do feel it and the ecosystem has matured quite a bit and would love to easily run it in CI in multiple of our repositories now.

One can do it with building & caching it as suggested in the docs, but it would be much more preferable to have pre-built binaries published for main linux/windows/mac targets (esp. linux) directly in the releases here (for example like cargo-deny or scache does it). Would be faster CI and easier to integrate in solutions that do not have caching.

Would this be possible to setup? One can take inspiration from some existing repos (like mentioned above) of how they build and publish it through github actions.

bholley commented 1 year ago

Would be happy to take a patch for this.

repi commented 1 year ago

this could be very good use case for the new cargo-dist to set up release workflow and deployment of binaries and try it out (and give feedback to @axodotdev about it).

maybe something @Gankra at axo would be interested in as another real test project to use it on?

staktrace commented 5 months ago

I have a PR up at https://github.com/mozilla/cargo-vet/pull/600 that sets up the cargo-dist release workflow. It was pretty painless, kudos @Gankra (and team) for that.

For context, we'd like prebuilt binaries published so that we can use them via the hermit tool.