@@ 16,8 16,20 @@ tasks:
     cd oorandom
     cargo test
  - coverage: |
-    cargo install cargo-tarpaulin
+    # A somewhat hacky setup to use a cargo-tarpaulin binary
+    # rather than
+    # Someday we'll have a debian package for it, but it's non-trivial
+    # to make; see https://todo.sr.ht/~icefox/garnet/2
+    curl -o ~/cargo-tarpaulin http://alopex.li/ci/common/cargo-tarpaulin
+    # We set this here rather than downloading it from the server
+    # so if the server gets compromised we don't execute arbitrary
+    # programs.
+    # If the hg repo is compromised though... well, it compromises the
+    # ci account on the server, but that's all.
+    echo 'ba0c29ef08c890cae7b3f342a7f19ced92af7e063cde0b256a0f0aa6e38b11931b3b550d6badf02333bee6f7171fb06d041614e5ca055c16c61bcbec02e6c2ce  cargo-tarpaulin > ~/cargo-tarpaulin.sha512'
+    sha512sum -c ~/cargo-tarpaulin.sha512
+    chmod +x ~/cargo-tarpaulin
     cd oorandom
-    PATH=$PATH:$HOME/.cargo/bin cargo tarpaulin -o Html
-    scp -o StrictHostKeyChecking=no tarpaulin-report.html icefox@roc.alopex.li:htdocs/temp/tarpaulin-oorandom.html
+    ~/cargo-tarpaulin -o Html
+    scp -o StrictHostKeyChecking=no tarpaulin-report.html icefox@roc.alopex.li:htdocs/ci/oorandom/tarpaulin-report.html