121–130 of 165 posts
I can imagine for example, importing keys from only the authors that I think I can trust, and passing a flag to cargo that only allows using those packages for cargo install or cargo add.
In this case I think just checking the top level crates signature (and not dependencies) would be enough to mitigate a lot of issues including typo squatting.
Can't tell you how often I've run: `pip install aws` This installs a library by some authors not affiliated with AWS. Instead of: `pip install awscli` Which is what you expect.
It would be nice if crates supported being signed with GPG or minisign or whatever. I can imagine for example, importing keys from only the authors that I think I can trust, and passing a flag to cargo that only allows using those packages for cargo install or cargo add. In this case I think just checking the top level crates signature (and not dependencies) would be enough to mitigate a lot of issues including typo…
If a package manager is starting from zero, and wants to have a privileged namespace such that a short name has a canonical value, it would make sense for those packages to be able to include a list of strings which the package should also reserve. That way "ripgrep" could include "rg", searching cargo for "rg" brings back "ripgrep", not a second package named "rg", and an install could tell the user the correct name…
Earlier quoted context omitted.
Can always-failing-to-compile crates be deployed to the registry?
Yes, `cargo publish` has the `--no-verify` flag if you want to force this. I think all the verification is client-side.
Eg:
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
If a package manager is starting from zero, and wants to have a privileged namespace such that a short name has a canonical value, it would make sense for those packages to be able to include a list of strings which the package should also reserve. That way "ripgrep" could include "rg", searching cargo for "rg" brings back "ripgrep", not a second package named "rg", and an install could tell the user the correct name…
Earlier quoted context omitted.
Because you hardly ever want to grep through your build artifacts or node modules? I don’t remember any one time I had to explicitly tell ripgrep to search through all the files in a repository
Ah, someone who hasn't experienced the... experience of working on a project that does very esoteric autotools magic. I will agree that in a sane project setup you don't need to search through all files including build artifacts ignored by git.