Skip to content

supply-chain-security.md

Latest commit

 

History

History
22 lines (16 loc) · 703 Bytes

supply-chain-security.md

File metadata and controls

22 lines (16 loc) · 703 Bytes

Rust Supply-Chain Security

elderheim treats dependencies as executable code.

Rules

  • Use crates.io releases by default.
  • Avoid git dependencies.
  • Keep dependency versions explicit.
  • Review build scripts, procedural macros, native *-sys crates, and CI edits.
  • Keep Cargo.lock committed for reproducible application builds.
  • Use cargo deny, cargo audit, SBOM generation, and release notes as release evidence.

Current Dependency Choices

  • clap: CLI argument parsing.
  • logos: lexer generation for BASIC frontends.
  • thiserror: structured errors.
  • cranelift-*: native object-code backend.

These versions were checked with cargo search during the 0.10.0 bootstrap.