How Go Mitigates Supply Chain Attacks

https://go.dev/blog/supply-chain

I found this an interesting read, and interesting to compare with what Rust does here. Some of it is just different defaults (almost all go commands are the equivalent of cargo's --locked by default), and I could imagine letting cargo users pick such defaults in their cargo config. That also relates to this infamous cargo issue. In some cases I feel Rust has a little catching up to do. For example, a Rust sumdb might be neat. :D