rust-secure-code / cargo-supply-chain

Gather author, contributor and publisher data on crates in your dependency graph.
Apache License 2.0
315 stars 18 forks source link

Cache of crates.io data dumps should expire #13

Closed HeroicKatora closed 3 years ago

HeroicKatora commented 3 years ago

Currently, all commands consider any data retrieved via cargo supply-chain update as valid.

This might silently leave you with very outdated data (#9 would provide a partial fix).

The usage should either be opt-in with an argument (--cached) or there should be some expiration policy. For example, we could consider the dumps outdated if they are older than one day and provide arguments to adjust this such that a duration of 0 ensures that no cache is used.

Shnatsel commented 3 years ago

Done in #14