Add capability to flatten dependency tree into a single directory for easier dependecy hack prevention

[adalfarus]

Problem

Supply chain attacks are hard to prevent when each packages depends on three others and you end up with hundreds of dependencies you need to check, and then re-check after every update permissible by the dep filter of all the crates that are in your tree. Or you need to add all dependencies of all packages to your dependencies with locked versions, which is also hard. Especially because you also need to update your deps to get fixes for known vulnerabilities.

Proposed Solution

Basically the sub command:

"cargo flatten --depth x"

where all packages deeper in the dependency tree than x are flattened into one directory which can then be committed to version control. When updating the dependencies, this approach could also make it easier to spot hacked packages as their source is not longer opaque and changes are tracked.

Notes

Should be relatively easy to implement, just copy the checked out repos to e.g. ./flatten and overwrite them when updating. The whole dep checking doesn't need to change, it would just need to check the depth of a package and copy it over if its over x.

[adalfarus]

It could be a global property in Cargo.toml or a dependency local property, the command sets the correct setting in Cargo.toml and flattens the deps. If the property is in Cargo.toml every cargo command that modifies deps should also flatten them.

[weihanglo]

Mind saying more about the difference between this proposal and cargo vendor except it accepting an extra --depth flag?

[adalfarus]

That the directory is automatically kept up to date by any command that modifies Cargo.lock. The feature could also be added to cargo vendor, the depth flag is not really unbelievably important.