Published cargo-witness: an open-source tool that detects Rust supply-chain attacks by diffing the published .crate on crates.io against the exact commit it was built from. It verifies against the OIDC-attested Trusted Publishing commit when available, so a
