Related: we&#x27;re wondering how to use Rust because currently all non-Rust dependencies in our org are pulled from:<p>- corporate source code control systems<p>- corporate central repositories<p>- caching&#x2F;proxying immutable repositories<p>These ensure all projects are built from known sources. We _know_ we can get consistent builds.<p>When using Cargo:<p>- Project owners update projects and don&#x27;t bump the version. New bugs &#x2F; security problems could be injected even though we haven&#x27;t changed a thing internally.<p>- crates.io isn&#x27;t always up.<p>- Trust: we legally can not trust (PCI compliance violations - 2015 rules (viral) ) the public crates.io repository. Besides PCI compliance, it&#x27;s not possible for crates.io to guarantee perfect security (so many reasons, obviously).<p>* I&#x27;m hoping folks who have addressed this issue (or are addressing it, or are planning on addressing it) would comment.