258
‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens (kevinpatel.xyz)
submitted 4 months ago by to c/programmer_humor@programming.dev
18 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 4 months ago (1 child)

Crates.io does support trusted publishing for GitHub and gitlab. It's not much, but it's Honest work.

... I which it supported forgego

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 13 points 4 months ago

    It's not enforced though, and there's no way as a consumer to see how a crate was published.

    To be extremely fair, crates.io has a huge maintenance bottleneck because AFAIK it doesn't even have a single dedicated developer. But that's definitely a big part of the problem.

    The Rust Foundation is really just not pulling in enough revenue to support the project properly. They really ought to figure out more revenue streams than just sponsorships and donations.

  • permalink
  • fedilink
  • source
  • parent