Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crev: dependency vetting with a web of trust

github.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Crev: dependency vetting with a web of trust

#11

Post by [deleted] »

nicoburns wrote: post #7
pornel wrote: post #4

Some background on this: Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://crates.io/crates/left_pad if you're wondering). This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware…

I'm pretty sure the left-pad crate is a joke. That functionality is in the standard library...

[deleted]

Re: Crev: dependency vetting with a web of trust

#12

Post by tln »

nicoburns wrote: post #7
pornel wrote: post #4

Some background on this: Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://crates.io/crates/left_pad if you're wondering). This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware…

I'm pretty sure the left-pad crate is a joke. That functionality is in the standard library...

The only dependency of left_pad:

https://crates.io/crates/kik

"waiting for a takedown notice :P"

Re: Crev: dependency vetting with a web of trust

#13

Post by fiddlerwoaroof »

mindB wrote: post #10
alexchamberlain wrote: post #8

It would be really cool if this could express claims about copyright and license, as well as code quality.

Could you elaborate on what you mean by this? Were you wanting people to be able to publish proofs that they've reviewed the legal standing of the code as well as the code itself for problems?

It would be useful to know if the MIT library you’re depending on pulls in a AGPL transitive dependency.

Re: Crev: dependency vetting with a web of trust

#14

Post by alexchamberlain »

mindB wrote: post #10
alexchamberlain wrote: post #8

It would be really cool if this could express claims about copyright and license, as well as code quality.

Could you elaborate on what you mean by this? Were you wanting people to be able to publish proofs that they've reviewed the legal standing of the code as well as the code itself for problems?

Yeah. For example, the original author could declare they own the copyright on xyz release and its released under a certain licence

Re: Crev: dependency vetting with a web of trust

#16

Post by wyldfire »

alexchamberlain wrote: post #8

It would be really cool if this could express claims about copyright and license, as well as code quality.

I don't think you want/need web-of-trust to evaluate licensing. You probably just want to see "what is the full set of (transitive) licenses I'm agreeing to when taking on this new dependency?" Right? If so, there's cargo-license [1] for that.

[1] https://github.com/onur/cargo-license

Re: Crev: dependency vetting with a web of trust

#17

Post by wyldfire »

alexchamberlain wrote: post #14
mindB wrote: post #10

Earlier quoted context omitted.

Could you elaborate on what you mean by this? Were you wanting people to be able to publish proofs that they've reviewed the legal standing of the code as well as the code itself for problems?

Yeah. For example, the original author could declare they own the copyright on xyz release and its released under a certain licence

That's stipulated by the crate metadata and the only authority of that claim is the author's, right? Why would you want/need bolstering of that claim by a web-of-trust? What would it mean if the WoT identified a different copyright owner than the author or a different license from the one the author offers?
Post reply on HN