Skip to content

Comments

build: Remove bundled protoc and build from source#610

Merged
LucioFranco merged 6 commits intomasterfrom
lucio/vendored
Mar 28, 2022
Merged

build: Remove bundled protoc and build from source#610
LucioFranco merged 6 commits intomasterfrom
lucio/vendored

Conversation

@LucioFranco
Copy link
Member

@LucioFranco LucioFranco commented Mar 25, 2022

This is an initial attempt to remove bundled binaries from prost-build and to instead compile protobuf from source. This is a much safer approach and reduces prost's vulnerability to supply chain attacks.

Reference #575 (comment) for more information on how this is implemented.

This also adds a test-vendored crate which ensures that vendoring works.

Closes #575

@LucioFranco LucioFranco marked this pull request as ready for review March 28, 2022 18:25
@LucioFranco LucioFranco merged commit fc9fbd9 into master Mar 28, 2022
@LucioFranco LucioFranco deleted the lucio/vendored branch March 28, 2022 20:38
danburkert added a commit to sisudata/prost that referenced this pull request Apr 7, 2022
)"

This reverts commit fc9fbd9.

The bundled protoc is very convenient, particularly for container
builds.
danburkert added a commit to sisudata/prost that referenced this pull request Apr 7, 2022
)"

This reverts commit fc9fbd9.

The bundled protoc is very convenient, particularly for container
builds.
@Thomasdezeeuw
Copy link

I just want to note that this change (I think) requires cmake to be install to build prost, which broke our build pipeline.

@LucioFranco
Copy link
Member Author

@Thomasdezeeuw right, cmake is now a requirement. There is #620 being worked on or you can just bundle the protoc binary yourself (or download it on CI) and provide it in the path to speed up compile times.

mdrach pushed a commit to sisudata/prost that referenced this pull request Aug 3, 2022
mdrach pushed a commit to sisudata/prost that referenced this pull request Aug 3, 2022
)"

This reverts commit fc9fbd9.

The bundled protoc is very convenient, particularly for container
builds.
mdrach pushed a commit to sisudata/prost that referenced this pull request Aug 4, 2022
)"

This reverts commit fc9fbd9.

The bundled protoc is very convenient, particularly for container
builds.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Supply chain security with embedded protoc binaries

2 participants