Build reproducibility
Open
for:security
needs:design
- Dominant language
- Rust
- Stars
- 188
- Forks
- 41
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 12
Description
Currently, most parts of the build are pinned to a given version using `rust-toolchain.toml` and `Cargo.lock` files. However some parts are not, essentially things installed globally, like `apt-get install`.
It's not great to force a version on the user, so a solution needs to be found to localize those global tools. Building in a chroot? Not enforcing the version but only measuring it? Getting rid of those global dependencies (like #607)?
Contributor guide
Assessment
This issue has not been assessed yet.