{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreiaelcnhjc4xz7x6nhqjiq2yrbomkd5lguwextlsj4swbsoezprc3e",
    "uri": "at://did:plc:ivbknywyskln22er3nkssdhl/app.bsky.feed.post/3modm5wcsvsm2"
  },
  "path": "/t/separating-fetching-from-building-for-better-security/24390#post_15",
  "publishedAt": "2026-06-15T15:29:54.000Z",
  "site": "https://internals.rust-lang.org",
  "textContent": "grothesque:\n\n>   * A first phase that roughly runs `cargo fetch` in a sandbox with network enabled.\n>\n>   * A second phase that runs `cargo build --locked` in a sandbox with network disabled.\n>\n>\n\n\nWhat about doing all process in a sandbox that has only access to `index.crates.io`?",
  "title": "Separating fetching from building for better security"
}