tree 38158216db0dfa50bc4219fc61143ab4ce1c9368
parent fe444c2f80da3aafb28a19457d9248c45f9dbbc1
author Wan-Teh Chang <wtc@google.com> 1665692902 -0700
committer Wan-Teh Chang <wtc@google.com> 1665711357 -0700

Install meson,cargo,nasm as Debian/Ubuntu packages

The current command used to install cargo is:
  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

This command executes a shell script that is not in the source
repository using `curl | bash`. This is a potential security
vulnerability. We should not pipe curl output directly to a shell.

The current command used to install meson is:
  pip3 install meson

Using pip install without manifest files (requirements.txt) and checksum
verification (--require-hashes) is a potential security vulnerability.

Bug: b/248582328
Bug: b/253297622