search

mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Improve handling of trust --all #500

Closed mystor closed 1 year ago

mystor commented 1 year ago

This patch makes a few changes to how trust --all is handled.

  1. trust --all will now also trust crates which fail to vet, even if they don't have any exemptions.

  2. A new flag, --allow-multiple-publishers, can be specified to also trust packages with multiple publishers.

  3. trust --all will now more intelligently pick the default criteira based on your existing audit graph, providing better support for custom criteria.

Fixes #499