Bus Factor +1 for crates (now dead)

Trust is definitely tricky. I think for this to work it needs to be wholly clear and transparent about what its goals are and who's involved.

I would favour a separate organisation whenever possible like we did with uuid, with the bus factor team having permissions on crates.io and a separate team having ownership of the repository in its organisation.

There's a bit of a difference in approach between centralising maintainership under a single umbrella organisation, and distributing it amongst disparate teams. I'm in favour of decentralisation here.

It doesn't necessarily need to factor in to this at all though if it's only concerned with being able to push a fork to crates.io under the same name. That's where I think the question what does it mean for the bus factor team to share ownership over a crate? matters.

5 Likes