4 ms·
GitHub shouldn't be a dependency for publishing Rust on crates.io
- Animats 4mo agoSadly, that's probably correct. No outside single point of failure that can cancel users at will can be allowed to gatekeep open source projects.
- sscaryterry 4mo agoEspecially not now, what if they're down? ;)
- veqq 4mo agoThis is a big issue. https://janetdocs.org/ https://janetdocs.org/ handles auth through GH which leads to... regular problems, unfortunately. I hope to migrate soon.
- ameliaquining 4mo agoSee the official project issue on this: https://github.com/rust-lang/crates.io/issues/326 https://github.com/rust-lang/crates.io/issues/326 TL;DR: They want to fix this, it's a lot of work that no one's being paid to do, there's a roadmap with specific tasks that need doing, volunteer contributions are welcome.
- sscaryterry 4mo agoJust going to say it out loud :) Its been known for 10 years. https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...
- NobodyNada 4mo ago10 years ago, GitHub had a far better reputation and the Rust ecosystem was much smaller and less load-bearing, so "what if someone doesn't have a GitHub account" was a theoretical concern for most people. So the issue was a low-priority backlog item that everyone agreed would be nice-to-have but there weren't enough people willing to volunteer their time to it over more important and more impactful work. Obviously, the situation has changed in recent years, so it's now considered a much higher priority by many people and some of them are actively working on it. But it's a lot of work to be done by volunteers, so it takes time. That's the reality of open-source projects: things get done when they are important enough to motivate someone to either fund it or work on in their free time, not according to idyllic roadmaps and schedules.
- sscaryterry 4mo agoWow, have you forgotten? https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis... 10 (edit: 8) years ago MS took over Github. The writing was on the wall then... No need to explain OSS to me, I maintain and contribute.
- ameliaquining 4mo agocrates.io was started long before the GitHub acquisition.
- sscaryterry 4mo agoYes, and your point?
- sscaryterry 4mo agoPro tip: Using "load-bearing" is heavily associated with LLM usage :)
- DrJokepu 4mo agoYou could say it’s the real smoking gun. With significant blast radius.
- ameliaquining 4mo agoPangram says human: https://www.pangram.com/history/208879e5-8510-479a-b96c-a20fb4a31e96?ucc=VavQZOMatca https://www.pangram.com/history/208879e5-8510-479a-b96c-a20f...
- sscaryterry 4mo agoThis is where I would insert the Little Britain "Computer says no" meme.
- NobodyNada 4mo ago
- ameliaquining 4mo agoCounterargument: https://www.astralcodexten.com/p/come-on-obviously-the-purpose-of https://www.astralcodexten.com/p/come-on-obviously-the-purpo...
- xboxnolifes 4mo agoA really popular saying on HN that's completely nonsensical under even a small amount of scrutiny.
- deleted 4mo ago[deleted]
- DyslexicAtheist 4mo ago> it's a lot of work that no one's being paid to do, aren't they like some kind of non-profit (in the legal sense) that is still able to take a lot of money (from players like Google and Co, to justify fixing this), as opposed to ... say the Zig foundation, ... that is is also "non-profit" but can't get money the same way?
- jojomodding 4mo agoThe non-profit (the Foundation) pays for specific things but it is not really there to hire people to work on things. It pays for infrastructure work and to pay the existing maintainers who often do review work. It also gives stipends to up-and-coming contributors for Open Source outreach programmes, but this are not really the people who you want to have immediately work on your critical infrastructure code.
- nottorp 4mo agoThat reminds me tailscale still depends on anyone-but-them for identity...
- righthand 4mo ago[flagged]
- hmry 4mo agoUsing crates.io is entirely optional, you can download a library's source code and specify the path to it in your cargo config file. (Which is not uncommon in production) For that matter, using cargo is optional, you can compile rust code using GNU make or shell scripts if you want to. (That's what the Linux kernel does)
- righthand 4mo agoStill many more reasons to learn C!
- deleted 4mo ago[deleted]
- antonvs 4mo agoWelcome to 1972, young padawan. You have a long journey ahead of you.
- kelnos 4mo agoI chose to learn C 25 years ago and avoid it now whenever I can. Life's too short to deal with memory unsafety.
- epage 4mo agoAn RFC was recently merged to unblock this: https://github.com/rust-lang/rfcs/pull/3963 https://github.com/rust-lang/rfcs/pull/3963 The implementation on this has started. Something to keep in mind is https://blog.m-ou.se/rust-is-not-a-company/ https://blog.m-ou.se/rust-is-not-a-company/. Rust is mostly driven by volunteers working on what they find interesting. Boring/uninteresting tasks depend on funding, a warm body to accept the funding, and a reviewer.
- echelon 4mo agoIt's not just that this is boring work, but there's disagreement about Cargo and crates.io's direction. There are a lot of changes people would like to make that get turned down. Crates.io and Cargo need namespaces, but the leadership flatly says no. There's a big problem with name squatting, and nothing is being done about this either. I get that there are more technically important issues around builds and reproducibility and the like, but this is pretty foundational stuff.
- stymaar 4mo ago> Crates.io and Cargo need namespaces, but the leadership flatly says no. They are favorable to crate-name-as-namespace (so that once you have the tokio crate you can use tokio as a namespace) and there's ongoing work on that. But as said above, it takes work to implement. There's no desire for other meaning of the word "namespace" because famously nobody ever made a well-reasoned proposal (despite the amount of social media outrage over the lack of namespace).
- kelnos 4mo agoThere's just so much prior art here, though. Docker hub has username-based and org-based namespaces (as well as a "blessed package" root with no namespace). Maven central uses reverse-DNS as a namespace (and Maven central/OSSRH requires that you prove you own the domain before you can publish to it). Even npm, probably the poster child for doing things wrong, has user- and org-based namespaces. This isn't a particularly difficult problem, and other package ecosystems have solved it many times in the past.
- mikey_p 4mo agoThe longer I go the more I have actually come to appreciate the way Packagist works for the PHP community, there are lots of cool things it does that I wish NPM or other registries did by default, like forcing you to package from a source repository, so that you can't upload a different artifact from what you keep in source control.
- ecshafer 4mo agoHow does a close source package work? Depending on the language its not super helpful, but a package that is closed source should be possible.
- hmry 4mo agoFor crates.io: They don't allow closed-source packages. But they're just the free community package index, you're not forced to use them. You can: - host a private index - host the proprietary binaries in a git repo and use a git dependency - commit the proprietary binaries into your source repo, and use a path dependency
- steveklabnik 4mo agocrates.io also only distributes source code.
- kelnos 4mo agoI'm not sure that really gives you the guarantees you think it does, though. For example, I could push some malicious code, tag it, wait for Packagist to finish pulling it to publish a package, and then amend history to remove the malicious code, rewrite the git-tag, and force-push both to the git server. This scheme makes it hard/impossible to push mismatching code by accident, but doesn't do much to stop a malicious actor.
- estebank 4mo agoThis kind of thing is one of the reasons crates.io distributes source only, and that published crate dependencies can't depend on other repositories (that might allow for that attack).
- jauntywundrkind 4mo agoThe teams support may be a bit trickier/less clear to move on, but generally: this feels like a great place where atproto / bluesky support would slot in well.
- dnfmfnfnfb 4mo agoI don’t see how that would be effectively useful for any aspect of the problems
- steveklabnik 4mo agoThe only thing GitHub is used as on crates.io is as an identity provider. Using your atproto identity is pretty straightforwardly a conceptual substitute.
- androiddrew 4mo agoWelcome to Golang packaging problems. Hope you get it sorted out
- sshine 4mo agoBut Sylvain Kerkour says Go's approach is much better than Rust's!
- steveklabnik 4mo agoThe shape is very different. The only thing crates.io uses GitHub for is for identity.
- bsder 4mo agoCan someone explain to me why the inverse domain name solution that everyone in the Java world converged on doesn't work? It's really not clear to me why people keep avoiding that.
- estebank 4mo ago1) Trawl registry for packages owned by domains. 2) Note expired domains and register them yourself. 3) Supply chain compromise. That, and not wanting people to fork out money for a domain as a requirement to participate in the ecosystem.
- bsder 4mo agoIn my personal opinion, if a rogue actor can compromise your project by buying you the equivalent of a beer and a pizza, I don't think anyone should trust you as a dependency to any extent.
- what 4mo ago$10/year is too high a price when I spend that much on my morning Starbucks order…
- msm_ 4mo ago
- vsgherzi 4mo agoI agree and so does the rust project. The main problem is that it's alot of work and it's hard. https://www.youtube.com/watch?v=zGS-HqcAvA4 https://www.youtube.com/watch?v=zGS-HqcAvA4 Here's a long video from jon gjengset that shows how it works and some of the effort already done to de-couple from github. Crates is widely used so it's a rebuilding the track while the train is driving kind of problem. It's just not a priority for the project right now, but I would also definitely like to see the issue done. It might be good for the rust project to vote on things like this during surveys so they know where to focus work!
- lorecore 4mo agoGo handles this well, kind of. It's super easy (in fact, transparent) to import from GitHub urls. You can self-host your Go packages, but it involves making and hosting some manifest files. Not as seamless as using GitHub, but still totally doable.
- fyrn_ 4mo agoIn practice, Go is much, much more github dependent than rust, most go packages are on github
- queenkjuul 4mo agoAren't all the ones in the actual Go registry mirrored, though? I thought I read that. They also make it trivial to vendor dependencies, idk if Crates handles that
- steveklabnik 4mo agoCrates.io hosts source code independently of GitHub. Cargo also makes vendoring dependencies trivial.
- dboreham 4mo agoMy take: publishing Rust crates shouldn't depend on any single internet property, including crates.io.
- deathanatos 4mo agoI think crates.io is essentially just the default, and you can point cargo to an alternate package repository, if you so desire. I've worked on projects where we vendored all third-party crates, for example, so our config just pointed to that vendoring, and I think support ought to be better these days…
- junon 4mo agoCorrect. You're welcome to mirror or host a private one. Cargo makes it _relatively_ easy to do (saying this as somewhat of a cargo hater).
- pyreko 4mo agoI mean... it technically doesn't? You can always point to other registries (or you can even just pull in git repos), we literally do this at work.
- rho138 4mo agoHoly fuck it’s been a decade. Nothing is that complex.
- r2vcap 4mo agoFrom a supply-chain perspective, Cargo is still in the same broad risk category as npm and PyPI: installing packages means trusting externally published code, including code that may execute during build or installation. Rather than looking for someone to blame - in this case, GitHub - we should focus on constructive ways to harden the ecosystem.
- rndhouse 4mo agoI'm working on a tool for collaboratively reviewing Rust crate dependencies: https://github.com/thirdpass-org/thirdpass https://github.com/thirdpass-org/thirdpass Also supports npm, PyPI, and Ansible Galaxy.
- kelnos 4mo agoThat's a separate issue of supply-chain risk, and crates.io using GitHub auth isn't really material to that. The gripe with using GitHub auth for crates.io is that GitHub is owned by a large, fickle corporation with a (shall we say) complicated history with open source, and people object on principled grounds to being forced to use GitHub in order to participate in the crates.io ecosystem.
- linzhangrun 4mo agoCargo tied itself to GitHub back when GitHub still looked like an open-source utopia. Now the dependency is deeply baked in, and rolling it back would be very hard.
- zombot 4mo agoGitHub, just like NPM, is a liability of the worst order. I'm sure it's just coincidence that both are owned by Microslop. Anyway, having either of those as a mandatory dependency is a big no-no.