You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`cargo-deny` is a cargo plugin for linting your dependencies. See the [book 📖](https://embarkstudios.github.io/cargo-deny/) for in-depth documentation.
11
+
`cargo-deny` is a cargo plugin for linting your dependencies. See the [book 📕](https://embarkstudios.github.io/cargo-deny/) for in-depth documentation.
12
12
13
13
To run on CI as a GitHub Action, see [`cargo-deny-action`](https://github.com/EmbarkStudios/cargo-deny-action).
14
14
@@ -46,6 +46,8 @@ The licenses check is used to verify that every crate you use has license terms
Copy file name to clipboardExpand all lines: docs/src/checks/sources/README.md
+9-1Lines changed: 9 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,11 +2,19 @@
2
2
3
3
The sources check ensures crates only come from sources you trust.
4
4
5
+
```bash
6
+
cargo deny check sources
7
+
```
8
+
9
+
<imgsrc="https://imgur.com/xdHFDWS.png"/>
10
+
5
11
## Use Case - Only allowing known/trusted sources
6
12
7
13
Cargo can retrieve crates from a variety of sources, namely registries,
8
14
git repositories, or local file paths. This is great in general and very
9
-
flexible for development. But esp. re-routing dependencies to git repositories increases the amount of sources that one would have to trust and may be something a repository want explicitly opt-in to.
15
+
flexible for development. But esp. re-routing dependencies to git repositories
16
+
increases the amount of sources that one would have to trust and may be
17
+
something a repository want explicitly opt-in to.
10
18
11
19
See [Why npm lockfiles can be a security blindspot for injecting malicious modules](https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/)
12
20
for the motivating reason for why this check was added.
0 commit comments