We currently pull rust-openssl from crates.io and this leaves an opening for a supply chain attack, especially as it also pulls in several dependencies (see cargo.lock) which are maybe less well maintained.
It might make sense to vendor rust-openssl and its dependencies rather than pulling it, allowing us to do cargo --frozen which prevents network access as well.
We currently pull rust-openssl from crates.io and this leaves an opening for a supply chain attack, especially as it also pulls in several dependencies (see cargo.lock) which are maybe less well maintained.
It might make sense to vendor rust-openssl and its dependencies rather than pulling it, allowing us to do
cargo --frozenwhich prevents network access as well.