3 ms·
Crates.io lists the authors as "The Rust Project Developers", and has the Rust libs team as an owner. The dependencies are almost all maintained by Rust libs te
by Manishearth 10y ago
Crates.io lists the authors as "The Rust Project Developers", and has the Rust libs team as an owner. The dependencies are almost all maintained by Rust libs team members or are otherwise trusted crates.
https://crates.io/crates/regex https://crates.io/crates/regex
(Regex moved out of the nursery a while back)
The nursery is more of a "These crates are officially blessed and we wish to make them part of rust-lang, unless the community comes up with something better".
The guarantees aren't advertised, they're known. We can do a better job of advertising this, some of the work this year is related to that.
- 1wd 10y agoSorry, I meant the author and license of e.g. this dependency of regex: https://crates.io/crates/aho-corasick https://crates.io/crates/aho-corasick I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this? Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there. > The guarantees aren't advertised, they're known. It is known. -- Jhiqui Glad to hear improving this is in the works anyway.