search

mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Suggest git audit failures in two stages #501

Closed mystor closed 1 year ago

mystor commented 1 year ago

This patch splits suggestions for git failures into two distinct stages, one of which suggests that the closest published version be audited, and then a suggestion of a delta-audit from that version to the git version. In order to keep backlog numbers accurate, we need to suggest both the delta and the base audit silmultaneously, which requires changes to how suggestions are resolved.

Care was taken to ensure that these new suggestions should interact correctly with other suggest features, such as registry suggestions and trust hints. This is done by making these features only operate on the "base" suggestion/published version when both are present.

Fixes #378

mystor commented 1 year ago

Leaving this as a draft for now, as it builds on the changes from #497, which haven't been merged yet.