How can I make garden use the binaries I already have on my system rather than installing outdated or duplicate versions of those? Seeing this as a potential supply chain attack vector, where are those being downloaded from anyway?

Hi @miniature-hydrogen-88599 , this is currently not possible. We have been pondering this a while back and i agree that it has a lot of benefits, however also some downsides. For example we test garden with all the plugin versions, that we distribute to ensure full functionality, which is more difficult to ensure with custom supplied versions of third-party tools. You can check where we download these tools in the spec for the different plugins e.g. https://github.com/garden-io/garden/blob/main/plugins/terraform/src/cli.ts#L79 for the terraform plugin. We always check shasums of downloaded binaries. But feel free to create an issue on GitHub and we can see if it gains some traction!