Initial patch for Systemd-manager.
Currently there is still security risk, because current cargo version doesn't verify checksums.
Cargo verify checksums starting with version 0.13, so once updated it would be safe to use cargo packages.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Wontfix | JoshStrobl | T24 Systemd-manager | |||
| Invalid | None | T1612 Systemd-manager |
Event Timeline
Comment Actions
git|https://github.com/mmstick/systemd-manager.git : a83a102ef918d0499a02da6a69ef113b7c82a160 needs to be changed to git|https://github.com/mmstick/systemd-manager.git : 1.0.0
+license : + - GPL-3.0
Can be changed to license : GPL-3.0
Comment Actions
Currently there is still security risk, because current cargo version doesn't verify checksums.
So why is it being merged then?
Comment Actions
Once T1718: Update Cargo to 0.13.0 is merged there is no security risk.
This patches should not be merged before.
Comment Actions
Cargo is 0.13.0 now, so there should not be any security risk.
Only problem may be that dependencies are downloaded during setup.
@ikey Is it OK to package cargo-based projects by this way?