Skip to content

Host the source code of our dependencies

We download our dependencies from crates.io in every new make all run, but if the crates.io servers goes offline we can't continue our development.

Solution

I propose to download the source code of all dependencies with the cargo-clone tool and host in our repositories (they don't occupy significant space).

Some benefits of doing this:

  • We can continue the development if crates.io is offline
  • Reduce the time to build the system because make fetch downloaded almost everything
  • Maybe we can protect our compilation from dependency chain attacks
  • More control over our dependency chain

Alternative

We can host our own crates registry using the panamax tool.

Edited by Ribbon