New Rust RFC Proposes Adding Support for Trusted Publishing to Crates.io

https://socket.dev/blog/new-rust-rfc-proposes-adding-support-for-trusted-publishing-to-crates-io

by feross • 2 years ago

24 13 2 years ago

socket.dev

carlmr• 2 years ago

Better late than never

milliams• 2 years ago

Direct link to RFC: https://github.com/mdtro/rfcs/blob/mdtro/trusted-publishing-...

hlandau• 2 years ago

The underlying lesson here should be that centralised package registries are unnecessary, yet new language ecosystems keep making the same mistake.

There's really no reason for NPM or crates.io to exist.

Go got this right.

lifthrasiir3• 2 years ago

"Unnecessary" is a very strong word and even Go has a centralized module proxy nowadays. So there is an obvious benefit of centralization here, and you should explain what and how much is the overside to give it up.

Turskarama2• 2 years ago

They might not be strictly necessary but they tend to solve more issues than they cause. Many languages which don't come with a centralized repository built in will tend to spontaneously gain one because they are in fact useful.

infamouscow2• 2 years ago

"Drunk driving may kill a lot of people, but it also helps a lot of people get to work on time, so it's impossible to say if it's bad or not." - Internet person

This is exhausting.

Arguments like this don't persuade anyone—in fact, they do the opposite. They just highlight that you don't have any reasonable points to make, and are left relying on unfalsifiable and absurd claims.

infamouscow2• 2 years ago

Zig also got this right.

janice1999• 2 years ago

Where did the request for namespaces on crates.io go? At the moment I have to investigate every crate someone recommends and its dependencies to avoid a possible future XZ situation (checking the GitHub, committers and if they have Linkedin profiles at legitimate companies). Having "mozilla/foo" or "rust-foundation/bar" would be a huge improvement.

lifthrasiir3• 2 years ago

Namespace is merely a workaround, not a solution. Arbitrary namespace prefix is still open for registration so it can be squatted just like package name. One essential part of the real solution would be sandboxing of build scripts.

bfrog2• 2 years ago

Not if it requires dns verification… which would be great.

New Rust RFC Proposes Adding Support for Trusted Publishing to Crates.io

Related Stories