Download the database over HTTPS #843
Conversation
| const ADVISORY_DB_DIRECTORY: &str = "advisory-db"; | ||
|
|
||
| /// The default URL from which the DB is downloaded | ||
| const DEFAULT_DB_URL: &str = "https://github.com/zip-rs/zip/archive/refs/heads/master.zip"; |
There was a problem hiding this comment.
This seems bogus in multiple ways... just for testing I guess?
FWIW the tarball seems a lot smaller:
There was a problem hiding this comment.
Oh there's a .tar.gz? Nice, I'll use that instead!
I already have the streaming .tar.gz extraction code too, so no need for even the cursor.
There was a problem hiding this comment.
Anything else I should fix here other than switching from .zip to .tar.gz?
There was a problem hiding this comment.
Looking good so far otherwise. Hopefully etags work for those resources.
There was a problem hiding this comment.
Well they do provide an etag in the response, so the worst case is we don't rely on the 304 and instead check the etag in the response headers and stop there. So no worries there.
Part of #750
Not actually wired up to
cargo audityet, just shows what the approach might look like