258
‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens (kevinpatel.xyz)
submitted 4 months ago by to c/programmer_humor@programming.dev
18 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 4 months ago (4 children)

I guess one benefit is rust development often doesn't use bleeding edge version for everything, where you pull the entirety of crates.io through your machine when you open your IDE. From what I've seen most projects use == versions and lock files.

I don't know enough about rust though. Could an attacker change historical crate versions to a payload and then cargo pulls them because they changed? Or will cargo only pull an update if you change to a different version on your machine?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 4 months ago

    You can't overwrite previously published versions.

    Application projects are recommended to check-in the Cargo.lock which pins dependency versions but you can always just run cargo update at any time which automatically upgrades all dependencies to the newest version allowed by the Cargo.toml.

    Some projects get around this by pinning the dependency in the Cargo.toml (using =) or by vendoring all their dependencies, which is a huge pain in the ass.

  • permalink
  • fedilink
  • source
  • parent