cargo-goggles
| Crates.io | cargo-goggles |
| lib.rs | cargo-goggles |
| version | 0.0.3 |
| created_at | 2024-04-01 06:57:17.101778+00 |
| updated_at | 2025-04-08 07:19:36.541018+00 |
| description | Verify that registry crates in your Cargo.lock are reproducible from the git repository |
| homepage | |
| repository | https://github.com/M4SS-Code/cargo-goggles |
| max_upload_size | |
| id | 1192271 |
| size | 91,993 |
cratesio-publishers (github:m4ss-code:cratesio-publishers)
documentation
README
cargo-goggles
Verify that registry crates in your Cargo.lock are reproducible from the git repository.
This cargo subcommand analyzes the following properties for crates in your Cargo.lock:
Cargo.tomlcontains arepositoryfield pointing at a valid git repository- For each of the releases you are using, a valid git tag is present on the release commit
- The tagged commit matches the value in
.cargo_vcs_info.json, if present - The contents of the crates.io release are reproducible from the files inside the repo
How to use it
# Install
cargo install --locked cargo-goggles
# Run it inside your project (must already contain a Cargo.lock file)
cargo goggles
Roadmap
- Cleanup most of the code
- Make it into a proper library and CLI
- Support registries other than crates.io
- Fix some flaws
- Make it pull previously cloned repositories when changes are available
- Stop relying on the
gitCLI - Make it faster
- Make it easy to see differences between the contents of the git repository and the registry
See also
- https://lib.rs/dash gives a very deep (auto-generated) analysis of a user's own crates, including whether the sources match the crates.io release.
- Rust: Does the published crate match the upstream source? (2021-10-03) and corresponding
crates_io_analyzertool. - https://github.com/link2xt/cargo-repack, an archived Python prototype of a similar tool.
- Backdooring Rust crates for fun and profit (2021-11-17) suggests protecting against Git repository and crates.io mismatch by vendoring dependencies and inspecting the diff.
License
Licensed under either of
- Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.