To me, the two major problems are:
- no namespaces
Someone uploads “serde2”? that’s blocked forever. Someone uploads a typo version of a popular package? Too bad for you, learn how to type.
- the github connection
If you want to contribute to crates.io you’re bound to github. No gitlab, codeberg, gitee, sourcehut, etc.
Not sure if there are any other problems, but those two seem like the biggest things and #1 is AFAIK not something they ever want to change + it would be difficult to as one would need a migration strategy.
- SavvyWolf ( @savvywolf@pawb.social ) English19•8 months ago
If Github isn’t used for source control, why on earth is it the only auth provider?
Why has crates.io given Microsoft the ability to control who can and cannot publish Rust code?
Namespacing is whatever, but IMO the real issue is the disproportionate and unnecessary amount of power given to a company known for pushing monopolies.
- BB_C ( @BB_C@programming.dev ) 12•8 months ago
- GitHub wasn’t always owned by Microsoft. At least get your dates right.
- Yes, GH shouldn’t be the sole auth provider.
- TechNom (nobody) ( @technom@programming.dev ) English19•8 months ago
While I don’t want to deny the problems of not having namespaces, they will introduce a new set of problems. One issue with Github and similar platforms with namespaces is that a search for a repo turns up multiple projects with the same name under different namespaces. It’s always a confusion as to which one is canonical. Another problem is that people are now going to name squat namespaces instead of project names. Imagine somebody registers the serde namespace. Their crates may be mistaken as the canonical one.
- Turun ( @Turun@feddit.de ) 7•8 months ago
I know a lot of people want namespaces. And I think it would be nice for a bigger project to have an obvious way to show which packages are part of this big project, and which are not. For example the different serde serialization formats would not need to be listed in the docs, but simply be present in one single serde-formats namespaces.
It it does fuck all for type squatting. Sure, now I’m safe from getting malicious code by doing tokio/tokiu-http, but tokiu/tokio-http can still be malicious!
The only solution to type squatting would be a checksum. So instead of adding Tokio to your toml file you’d have to add e.g. tokio-fld, with the fld part being some kind of check that is derived from the name. Similar to a hash, all names that are similar to tokio would get a wildly different suffix.
It it does fuck all for type squatting. Sure, now I’m safe from getting malicious code by doing tokio/tokiu-http, but tokiu/tokio-http can still be malicious!
You are indeed correct. I hadn’t considered that!
The checksum idea might work 🤔 That definitely could be possible with the new registry.
- Anders429 ( @Anders429@programming.dev ) 6•8 months ago
For #2, there isn’t anything stopping a separate auth system not through GitHub. Really just needs someone to own the implementation. See https://github.com/rust-lang/crates.io/issues/326#issuecomment-216662599 for past discussion surrounding this.
- verstra ( @verstra@programming.dev ) 4•8 months ago
Isn’t github used only as the auth provider? It is not using any git features, just leaning on the security guarantees of github. I don’t find this too alarming.
If you want, you can use git links when declaring dependencies in Cargo.toml. So alternative to crates.io is basically any git host already!
Isn’t github used only as the auth provider?
Still makes you bound to github. Can’t publish to crates.io without github.
just leaning on the security guarantees of github
What security guarantee does github have? I can create a new account right now with a random email, sign up for crates.io and type-squat a package.
If you want, you can use git links when declaring dependencies in Cargo.toml. So alternative to crates.io is basically any git host already!
Sure, but how do you discover the package? That’s the other function of a registry. Also, I could easily just add another package as a submodule, but that’s not the point.
- Kevin Herrera ( @kherge@beehaw.org ) English3•8 months ago
I think the security guarantee is for the user and their credentials, not the community and trustworthiness of individuals.
- anlumo ( @anlumo@feddit.de ) 1•8 months ago
Semver checks don’t work with straight git urls, since you can only link to an explicit branch or commit, not a version.
- BB_C ( @BB_C@programming.dev ) 1•8 months ago
version
can be passed withgit
actually. And it will need to match with the version set inCargo.toml
from the git source.I wouldn’t call that an alternative to crate registries though (of which,
crates.io
is only one impl).Also tangentially related,
cargo-vendor
is a thing.- anlumo ( @anlumo@feddit.de ) English1•8 months ago
Semver strings allows stuff like “version 2.5.x, but below 2.5.6”. Then cargo calculates the best solution for satisfying all dependency specifications from all packages using a single version (if possible).
Specifying a version in addition to the git branch doesn’t help there at all, because you still have to do it manually then.
- BB_C ( @BB_C@programming.dev ) 1•8 months ago
Yes. That is in part why I mentioned that it’s not a real alternative, and mentioned
cargo-vendor
as a possible basis for a less manual serviceable solution.Serviceable, but not necessarily good still. Anti-
crates.io
extremists would still be better off using an alternative crates registry*.* That’s something that already exists btw. True extremists don’t have to wait for the HN leak-promised Good Stuff.
- Aloso ( @aloso@programming.dev ) 3•8 months ago
I don’t understand the “serde2” issue. Isn’t “someusername/serde” strictly worse than “serde2”?
GitHub being the only auth provider is something the maintainers wanted to fix, but didn’t have enough bandwidth to implement. I think they would welcome contributions!
- Júlio Gardona ( @jcbritobr@mastodon.social ) 3•8 months ago
@onlinepersona Got this issue two days ago. Someone upload a package with same name of mine. I was need to change the name to also upload.
Yep, so did I. Had to come up with a long-version of my package name in order to upload it. Not much of a problem for me as nobody uses the package but me - at the moment. If that ever changes, it’ll be confusing.
- smorks ( @smorks@lemmy.ca ) English2•8 months ago
there’s https://lib.rs/, never actually used it myself, but it calls itself an alternative to crates.io
- anlumo ( @anlumo@feddit.de ) 6•8 months ago
That’s just for the web-based UI, not the database behind it.
- smorks ( @smorks@lemmy.ca ) English2•8 months ago
ah ok, so i’m assuming it doesn’t fix either of the issues listed then. thanks.
Not sure how that’s an alternative as there’s no way to add anything to it. It seems more like an aggregator that a registry.