Cargo Crusader Hark, Rust crate author! The battle for Rust's reputation as The Most Reliable Software Platform Ever is here, and nobody is free of responsibility. The future of Rust, dear Rustilian, is in your hands. Join the Cargo Crusade and bring the Theory of Responsible API Evolution to the n…

This is a fascinating idea! Does it also consider semver? I mean, if I bump the major version of my crate, will it be considered "OK" even if I make some breaking changes? Looking at the code, it seems that the reverse_dependencies crates.io API simply lists all the crates that depend on my crate.…

[image] brson: bring the Theory of Responsible API Evolution to the non-believers The Theory of Responsible API Evolution looks excellent! Have people considered making a tool (or extending cargo) that will automatically report on API changes / potential breakages, and the corresponding semv…

[image] brson: Rustilian I think you'll find the correct term is "Rustacean". This is a Rustilian: [image] This is a Rustacean: [image] Lookit 'im. 'e wouldn't hurt anyone. Note the protective type-system shell, guarding against a cruel, heartless world that just wants to crush him wit…

Actually, thinking about this more, I wonder if we shouldn't "just" add sandboxing to Cargo. I started writing up an issue, but I'm not even sure if it's a tractible idea (do we want Cargo to start making promises about security of compilation?). One major issue I can think of is how on earth to m…

Are not md5 sums more than enough??

[image] tyoc213: Are not md5 sums more than enough?? For what?

for "That way, the "acquire dependencies" part should be safe" anyway, maybe I misunderstood something (sandboxing as security instead of only your build isolated from the rest of cargos in your system).

Yes. Acquiring dependencies should be safe because it's just downloading packages, not actually building or running anything. The point is to divide it from the definitely not safe "test" part.

Making crusader secure seems out of scope. You should just run it on Travis or whatever. However it's possible you could hack something on top of GitHub - pcwalton/gaol: Cross-platform application sandboxing for Rust

Cargo Crusader 0.1 - Test the downstream impact of Rust crate changes before publishing

announcements

brson August 17, 2015, 11:20pm 18

@DanielKeep I did not know that! Here's a bug https://github.com/brson/cargo-crusader/issues/5

Topic		Replies	Views
PSA: Check if your Cargo crates are clean and tagged help	27	1828	April 6, 2024
Announcing: cargo_crev_reviews - Write cargo-crev reviews in GUI with a cross-platform app written in full-stack rust announcements	1	614	December 30, 2021
Cargo dependency hell	37	15830	July 11, 2018
Signature based API comparison	27	8117	December 22, 2015
How does crates.io differ from npm community	51	9008	December 6, 2018

Cargo Crusader 0.1 - Test the downstream impact of Rust crate changes before publishing

Related topics