2 ms·
I do think that there's some work that can be done to improve reporting on our side: cargo should be able to report not just "how many crates are in the dep tre
by estebank 2y ago
I do think that there's some work that can be done to improve reporting on our side: cargo should be able to report not just "how many crates are in the dep tree" but rather "how many owners am I depending on" and "how many repositories am I depending on". For example, I just noticed that there's no way to see in crates.io other crates that live in the same repository, like it does per owner, even though it has that information available.
- rectang 2y ago> "how many owners am I depending on" Yes, knowing that would be helpful! Is there a way to whitelist owners/publishers in Cargo?
- estebank 2y agoNo tool for that exists afaik, but all the pieces to make it are there.
- 0x457 2y agoThere is `cargo-deny` that handles some enforcement: https://github.com/EmbarkStudios/cargo-deny https://github.com/EmbarkStudios/cargo-deny. Doesn't handle authors, but I suspect it's easy to add? There is really just a handful of crates that nearly often get pulled in and probably like 5 authors across them. Supply chain harderning is pretty easy in rust: caro-deny, cargo-suply-chain, cargo-crev, cargo-vet, cargo-{s}bom and probably a few more I can't remember.
- claytonwramsey 2y agoCargo currently has `cargo tree`, which prints out a dependency tree. There's an extension to cargo which also shows how many people have the ability to push to your dependencies, titled `cargo-supply-chain`. https://github.com/rust-secure-code/cargo-supply-chain/ https://github.com/rust-secure-code/cargo-supply-chain/
- nicoburns 2y agoYeh, this would be great. I'd also love to see the ability to publish multiple library crates as a single package.