Why stdx is not on crates.io

Post by alphabeta3r56 » Wed, Jun 17, 2026, 3:58 PM UTC

sheept wrote: post #14

cetra3 wrote: post #2

It just looks like stdx has copied stuff from crates and put it in a git repo. It feels like this is worse than a package manager? As in why would I trust a random git repo to keep things up to date over the officially published channel?

Plus, with forks anyone can publish a commit accessible from the main repo, so one could disguise a malicious version of stdx by forking the repo, pushing their charges, then setting the rev: base64 = { git = "https://github.com/rust-stdx/stdx", rev = " " }

Post by jamesmunns » Wed, Jun 17, 2026, 3:59 PM UTC

weinzierl wrote: post #20

stdx is not the best example. The most popular package that is not on crates.io is probably embassy. Also Debian tries to build and distribute independently from crates.io. So crates.io is important but is not the (Rust) world.

Post by progval » Wed, Jun 17, 2026, 4:04 PM UTC

simonask wrote: post #18

rdtsc wrote: post #9

> Also, you can only create a crates.io account with a GitHub account Oh is that true? They tied themselves to Microsoft it seems. What about people who won't or can't use GitHub.

As far as I understand, this is purely a result of lack of maintainer resources. Apparently, nobody has been bothered enough by this to contribute the relevant changes. Keep in mind that all of rustc and libs development takes place on Github.

Post by g-b-r » Wed, Jun 17, 2026, 4:06 PM UTC

weinzierl wrote: post #15

rdtsc wrote: post #9

> Also, you can only create a crates.io account with a GitHub account Oh is that true? They tied themselves to Microsoft it seems. What about people who won't or can't use GitHub.

Yes, unfortunately it is true. Sad, but I could live with that. What in my opinion is unacceptable is that it requires you to give permission to "read your organization and team membership and private Projects" . I made a separate GitHub account (weinzierl-trusted-publisher) for crates.io which is far from ideal, because it works completely against the idea to build trust for a single unified identity online, but ¯\(…

Post by weinzierl » Wed, Jun 17, 2026, 4:12 PM UTC

g-b-r wrote: post #27

weinzierl wrote: post #15

Earlier quoted context omitted.

Yes, unfortunately it is true. Sad, but I could live with that. What in my opinion is unacceptable is that it requires you to give permission to "read your organization and team membership and private Projects" . I made a separate GitHub account (weinzierl-trusted-publisher) for crates.io which is far from ideal, because it works completely against the idea to build trust for a single unified identity online, but ¯\(…

Multiple free accounts are also against GitHub TOS