bunnie 33948e70d6 initial verifier attempt ... verification is sort of pointless, because: The Cargo.toml file is parsed and reformatted by the packaging tool to normalize its contents. Thus, the Cargo.toml file of the downloaded version never matches the Cargo.toml file that's actually used. Unfortunately, there doesn't seem to be an easy way to check the equivalence of two Cargo.toml files, except for recursively and deeply parsing through and comparing all the possibile keys and values of the abstract key/value tree. This is a much bigger project than I'm prepared to figure out today. As a hack, we compare to the Cargo.toml.orig file. Which is...kind of OK, but really, this opens us up to attacks where someone just has to replace a version on a package or even just swap out an entire package for a malicious one by just using package name re-assignment which is a thing that the format supports. In other words, all this checking is kind of pointless because it's super-easy to swap out key crates for whole other crates and have it go undetected.		2022-10-05 05:33:24 +08:00
..
log-server	add a README to the log api	2022-10-02 23:29:14 +08:00
susres	fix susres API docs and bump version for upload to crates.io	2022-10-03 04:34:15 +08:00
ticktimer	absorb susres package bump	2022-10-03 04:38:59 +08:00
xous-api-names	initial verifier attempt	2022-10-05 05:33:24 +08:00