I think this is the important point. They’ve removed clap (argument parsing library) as a dependency, but they continue to trust cargo (the rust build tool) that uses that library and is primarily maintained by the same developer?
I feel like if they’re willing to trust the developers of the standard library and the official compiler and build tool, then they might as well trust clap as well.
This feels like removing dependencies just to say they did. But it may turn out well. Maybe there are “dependency skeptics” who will be won over when they see fewer dependencies.
Comments
I think this is the important point. They’ve removed clap (argument parsing library) as a dependency, but they continue to trust cargo (the rust build tool) that uses that library and is primarily maintained by the same developer?
I feel like if they’re willing to trust the developers of the standard library and the official compiler and build tool, then they might as well trust clap as well.
This feels like removing dependencies just to say they did. But it may turn out well. Maybe there are “dependency skeptics” who will be won over when they see fewer dependencies.
Clap ends up in your binary, Cargo does not.
if cargo was malicious it would affect the binary, which is the point
Trusting trust Steve.