I'm updating my Rust projects to harden them against supply chain attacks:
- explicit allowlist of hashes for build scripts in the project
- `min-publish-age` of 7 days for deps updates, using the nightly cargo feature
- ensure no jobs that could run a build script have GH tokens

#rust #rustlang

@predrag How robust do you think it is these days to isolate certain tokens from routine CI testing jobs? I’m paranoid that it’s still a pile of configuration footguns, so I haven’t looked into it recently. (But it seems that `npm` will soon make it effectively mandatory.)

@lgarron right now the worst part is that GitHub demands you give it a PAT if you want workflows to create PRs that can auto-merge. So you have to bend over backwards a bit: generate the change set in one job, upload the patch file as an artifact, download it in another job with the token, etc.

Other than that, with some elbow grease and/or AI tokens, it seems reasonably doable.

I'm currently in the middle of hardening cargo-semver-checks with this and other ideas — if you have time and interest, I'd love your thoughts: https://github.com/obi1kenobi/cargo-semver-checks

@predrag Is `min-publish-age` released already? How do I configure it?

@buherator it isn't stable but will be soon. You can use nightly for the update though, and I think the diagnostics will point you in the right direction if you don't get it right on the first try