> but adding a new crate still requires an explicit approval process, even when uploads are sponsored by seasoned Debian Developers. What’s the additional secu

> but adding a new crate still requires an explicit approval process, even when uploads are sponsored by seasoned Debian Developers. What’s the additional security benefit of the explicit approval? A major problem with Rust (for me) is the multitude of dependencies required even for trivial software, which complicates supply-chain monitoring. Auto-approval for crates gives me a bad feeling.