search

mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Metadata cache invalidation issue for unpublished crate #512

Open mystor opened 1 year ago

mystor commented 1 year ago

In https://bugzilla.mozilla.org/show_bug.cgi?id=1842331 it was discovered that we cache the unpublished metadata within the crates-io cache and don't attempt to check the index daily to invalidate this cache when a new version is published. We should probably make sure to check the index more frequently and use discovering that the crate has been published to invalidate and fetch the crate's metadata from crates.io.

bholley commented 1 year ago

@mystor Is this something we should fix in a dot release?

mystor commented 1 year ago

It's probably worth fixing, yeah. We'd need to tweak how our caching works around metadata somewhat in order to get a reasonable setup here. I don't imagine it'll be that tricky to do once I can find some time to dig into the code, but I haven't had the time for it lately.