I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.
5 Comments
treadful@lemmy.zip · 5 pts · 25d
Guess it was just a matter of time.
chickenf622@sh.itjust.works · 4 pts · 25d
Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.
naonintendois@programming.dev · 2 pts · 25d
How do you set that up?
chickenf622@sh.itjust.works · 5 pts · 25d
I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.
blazebra@programming.dev · 1 pts · 25d
Configure your updater and use exact or semi-exact versions.