4 ms·
Is there a way to buy into PGP identity-based controls for crates.io packages? To say, "I trust the keys in this whitelist, so trust packages signed by those ke
by rectang 5y ago
Is there a way to buy into PGP identity-based controls for crates.io packages? To say, "I trust the keys in this whitelist, so trust packages signed by those keys."
> Thirdly, using cloud developer environments such as GitHub Codespaces or Gitpod. By working in sandboxed environments for each project, one can significantly reduce the impact of a compromise.
That's appealing but expensive. I wish I could effectively sandbox a local developer machine. External boot drives, maybe?
- gpm 5y agoCargo-crev is that sort of web of trust, but it's really in it's infancy.
- rectang 5y agoCargo-crev's writ seems to be much more expansive and nebulous than security: https://github.com/crev-dev/cargo-crev/wiki/Howto:-Create-Review-Proofs https://github.com/crev-dev/cargo-crev/wiki/Howto:-Create-Re... > While it's still open for debate, the current opinion is that additional fields are not useful for the downstream users. Instead they just complicate their life, putting the burden of the decision from the reviewer onto them. At the end, a downstream user of a review just wants to know: "is it OK to use this package or not?". Your role as a reviewer is to provide that judgment. That irks me. I don't care about popularity contests, I only care whether a crate is malicious or not. If it has security vulnerabilities, I can deal. But if downloading and running a proc macro crate build runs gives an attacker remote code execution and they install a keylogger on my dev box, that's altogether different.
- ChrisSD 5y agoIf the crate is actively malicious then crates.io should be informed immediately and the crate removed. Probably the author too. If need be RustSec can issue a security advisory.