Make it easier to audit upgrades by diffing .crate files
              
              #7020
            
            
                  
                    
                      epage
                    
                  
                
                  started this conversation in
                Feature Requests
              
            Replies: 0 comments
  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment
  
        
    
Uh oh!
There was an error while loading. Please reload this page.
-
Recent supply-chain discussions had me thinking it could be helpful to see the differences in the published
.cratefile. There is currently a third-party tool for this but figured having it built directly in would raise awareness and make it easier to use.A bonus is an idea I posted on the diff.rs issue tracker which is diffing across crates. This would help when looking at potential forks or supply chain attacks to figure out what was actually done (e.g. I just recently found
clap_builder_cryowhich didn't change the repository links, making it harder to figure out what was going on.Beta Was this translation helpful? Give feedback.
All reactions