# PSA: please "git tag" your crates.io releases **URL:** \ **Category:** uncategorized\ **Created:** [November 13, 2018, 6:52am UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223 "2018-11-13T06:52:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![birkenfeld](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/birkenfeld/32/1121_2.png) [@birkenfeld](https://users.rust-lang.org/u/birkenfeld)\ **Post date:** [November 13, 2018, 6:52am UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/1 "2018-11-13T06:52:50Z")
Time and again, I come across crates where I'd like to check what changes are already released, and where it's near impossible to find out which exact git commits the releases are based on. The only way is to check the timestamps, but even that's kind of hard since commits in the PR queue can be much older than the point they are merged at. Sometimes there is some dedicated release commit ("bump version to x.y") which helps, but it's not needed if you just tag after `cargo publish` succeeds. It's really quite easy and helps tremendously. It's also very useful for verification purposes ("did that [crates.io](http://crates.io) source really come from that repository"). ---
**Author:** ![matklad](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/matklad/32/41370_2.png) [@matklad](https://users.rust-lang.org/u/matklad)\ **Post date:** [November 13, 2018, 7:42am UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/2 "2018-11-13T07:42:53Z")
i think we can and should warn on Cargo publish, if the commit is not tagged, the same way we warn if there are uncommitted changes. Could you open an issue on the Cargo repo perhaps? ---
**Author:** ![bluss](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/bluss/32/4051_2.png) [@bluss](https://users.rust-lang.org/u/bluss)\ **Post date:** [November 13, 2018, 10:17am UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/3 "2018-11-13T10:17:57Z")
For example [Cargo release](https://github.com/sunng87/cargo-release) makes the tag _after_ "cargo publish". I think this is a good practice, since I don't want to make a tag for a publish that failed. (But that can be handled, just need to remember to delete any failed publish's tag before pushing.) Using such a release wrapper is a good idea - it makes the git tagging a part of the publishing step. With many crates, I wouldn't have bothered with tags if it wasn't part of an integrated process. (I've since noticed how useful tags are for release management and checking what changed since a specific release). ---
**Author:** ![matklad](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/matklad/32/41370_2.png) [@matklad](https://users.rust-lang.org/u/matklad)\ **Post date:** [November 13, 2018, 12:22pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/4 "2018-11-13T12:22:16Z")
Interesting point! I think that making it built-in to Cargo is a significant thing: I expect that people who regularly forget to tag things(like me) are those who don’t use cargo release for no real reason. I can imagine that we can add something like cargo release —tag That way, we can have “tag after release”, and we get automatic naming of the tags. A warning looks like a simpler feature at the first sight, and —tag could serve like a way to fix the warning easily. ---
**Author:** ![carols10cents](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/carols10cents/32/655_2.png) [@carols10cents](https://users.rust-lang.org/u/carols10cents)\ **Post date:** [November 13, 2018, 12:48pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/5 "2018-11-13T12:48:11Z")
> [@matklad](#): > > i think we can and should warn on Cargo publish, if the commit is not tagged, the same way we warn if there are uncommitted changes. Could you open an issue on the Cargo repo perhaps? > [@matklad](#): > > cargo release —tag Not everyone uses git though ☹ Perhaps this could be a cargo plugin instead? ---
**Author:** ![carols10cents](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/carols10cents/32/655_2.png) [@carols10cents](https://users.rust-lang.org/u/carols10cents)\ **Post date:** [November 13, 2018, 12:49pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/6 "2018-11-13T12:49:45Z")
> [@birkenfeld](#): > > Sometimes there is some dedicated release commit (“bump version to x.y”) Another trick I use is doing `git log` or `git blame` on `Cargo.toml`. ---
**Author:** ![hellow](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/hellow/32/11281_2.png) [@hellow](https://users.rust-lang.org/u/hellow)\ **Post date:** [November 13, 2018, 1:11pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/7 "2018-11-13T13:11:03Z")
> [@carols10cents](#): > > Not everyone uses git though ☹ Perhaps this could be a cargo plugin instead? Good point! Afaik there are two VCS supported right now for cargo, HG and git, right? How about checking if the project is under source control and emit a warning conditionally? (I don't know how HG works, but I guess they also have tags) ---
**Author:** ![matklad](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/matklad/32/41370_2.png) [@matklad](https://users.rust-lang.org/u/matklad)\ **Post date:** [November 13, 2018, 1:35pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/8 "2018-11-13T13:35:31Z")
It’s true, but I think absolute majority does use git, and we already have git-specific logic there: > It would be much less useful as a plugin: cargo release already exist, and most people just don’t use it. Plugins are useful for stuff you know you need, but for stuff you don’t know you need, I fear we need built-in warnings, if the cost/benefit ratio is reasonable. Aside: why do we special-case git here? The technical reason is that we already ship libgit2 as part of Cargo to interact with index, so the implementation is easy. For mercurial, pijul, etc we’ll need either to call to external binary (which adds a host of new error conditions) or ship libgit2-analogs with Rust (which is a rather large dep for a relatively small feature). The non technical reason is probably that git, at the moment, is indeed the most popular vcs for Rust crates. ---
**Author:** ![kornel](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/kornel/32/4823_2.png) [@kornel](https://users.rust-lang.org/u/kornel)\ **Post date:** [November 13, 2018, 1:46pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/9 "2018-11-13T13:46:16Z")
I'm advocating for Cargo to automatically add equivalent of `git-rev = $(git rev-parse HEAD)` to the rewritten `Cargo.toml` in the package. This would allow [crates.io/](http://crates.io/)[crates.rs](https://crates.rs) to link versions to git. ---
**Author:** ![birkenfeld](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/birkenfeld/32/1121_2.png) [@birkenfeld](https://users.rust-lang.org/u/birkenfeld)\ **Post date:** [November 13, 2018, 2:26pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/10 "2018-11-13T14:26:16Z")
> [@bluss](#): > > Using such a release wrapper is a good idea - it makes the git tagging a part of the publishing step. I agree, and I'll (try to remember to) try out `cargo release` next time I have an opportunity. > [@carols10cents](#): > > Another trick I use is doing `git log` or `git blame` on `Cargo.toml` . I've used that too, but unfortunately some tend to bump the version in `Cargo.toml` directly _before_ a release, while others do it directly _after_ ☹ > [@kornel](#): > > I’m advocating for Cargo to automatically add equivalent of `git-rev = $(git rev-parse HEAD)` to the rewritten `Cargo.toml` in the package. This would allow [crates.io/](http://crates.io/)[crates.rs](https://crates.rs) to link versions to git. This would already be a step up! Am I remembering correctly that cargo already warns about uncommitted changes on publish? (There's of course no guarantee that the commit exists in the repo, but there's always ways to screw up if you want to.) As far as alternate VCS go, there's already an extensive selection implemented for `cargo new`; this handling should have alternatives as well. ---
**Author:** ![mmmmib](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mmmmib](https://users.rust-lang.org/u/mmmmib)\ **Post date:** [November 13, 2018, 3:27pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/11 "2018-11-13T15:27:56Z")
> [@hellow](#): > > Afaik there are two VCS supported right now for cargo, HG and git, right? according to `cargo help init`, i can specify the following for `--vcs`: ```rust [possible values: git, hg, pijul, fossil, none] ``` Maybe this has to do with which VCS software is installed on the machine though? ---
**Author:** ![steveklabnik](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/steveklabnik/32/120_2.png) [@steveklabnik](https://users.rust-lang.org/u/steveklabnik)\ **Post date:** [November 13, 2018, 3:41pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/12 "2018-11-13T15:41:29Z")
I’ve wanted cargo publish to add a git tag for a long time; I have a three digit issue open for it as a feature request, with a possible design. ---
**Author:** ![mmmmib](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mmmmib](https://users.rust-lang.org/u/mmmmib)\ **Post date:** [November 13, 2018, 3:44pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/13 "2018-11-13T15:44:45Z")
[https://github.com/rust-lang/cargo/issues/841](https://github.com/rust-lang/cargo/issues/841) ---
**Author:** ![matklad](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/matklad/32/41370_2.png) [@matklad](https://users.rust-lang.org/u/matklad)\ **Post date:** [November 13, 2018, 4:10pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/14 "2018-11-13T16:10:33Z")
Added some mentoring instructions: [https://github.com/rust-lang/cargo/issues/841#issuecomment-438322649](https://github.com/rust-lang/cargo/issues/841#issuecomment-438322649) I think this would’t be too hard to implement, so if someone from Cargo team adds E-mentor label, we might get this fixed soon. ---
**Author:** ![mmmmib](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mmmmib](https://users.rust-lang.org/u/mmmmib)\ **Post date:** [November 13, 2018, 5:22pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/15 "2018-11-13T17:22:34Z")
Semi-related, i read [this post](https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5) (Ctrl+F GitHub for the relevant part) a while ago, where the author points out that on npm it's possible to publish a package without the source ever showing up in any public git. Does that problem exist as well with cargo/crates.io? Is there any web interface where i can browse the source+history of the published crate versions? ---
**Author:** ![birkenfeld](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/birkenfeld/32/1121_2.png) [@birkenfeld](https://users.rust-lang.org/u/birkenfeld)\ **Post date:** [November 13, 2018, 5:32pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/16 "2018-11-13T17:32:55Z")
> [@mmmmib](#): > > where the author points out that on npm it’s possible to publish a package without the source ever showing up in any public git. Does that problem exist as well with cargo/crates.io? Of course it is. And that's not a "problem" so much as giving crate authors the freedom to not use git, or any VCS at that. The matter of this thread is that _if you're already using a public repository_, it should be common courtesy to tag the releases there. ---
**Author:** ![mmmmib](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mmmmib](https://users.rust-lang.org/u/mmmmib)\ **Post date:** [November 13, 2018, 5:44pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/17 "2018-11-13T17:44:38Z")
But the source of crates hosted on [crates.io](http://crates.io) is public anyway (it ends up in our local cargo caches when we use the crates), and doing diffs between releases does not require a VCS. ---
**Author:** ![bluss](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/bluss/32/4051_2.png) [@bluss](https://users.rust-lang.org/u/bluss)\ **Post date:** [November 13, 2018, 6:56pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/18 "2018-11-13T18:56:09Z")
It's since recently sneaking in this info on publish, [https://github.com/rust-lang/cargo/pull/5886](https://github.com/rust-lang/cargo/pull/5886) seems to be under the radar for now. ---
**Author:** ![hellow](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/hellow/32/11281_2.png) [@hellow](https://users.rust-lang.org/u/hellow)\ **Post date:** [November 14, 2018, 7:33am UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/19 "2018-11-14T07:33:52Z")
Nice to know. The reason why I only came up with hg is the configuration doc for cargo [Configuration - The Cargo Book](https://doc.rust-lang.org/cargo/reference/config.html) > # By default `cargo new` will initialize a new Git repository. This key can be > # set to `hg` to create a Mercurial repository, or `none` to disable this > # behavior. > `vcs = "none"` Is this just outdated or just an example (then I would like to see "This key can be set to hg for example..." ---
**Author:** ![mmmmib](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mmmmib](https://users.rust-lang.org/u/mmmmib)\ **Post date:** [November 14, 2018, 12:44pm UTC](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/20 "2018-11-14T12:44:35Z")
> [@hellow](#): > > Is this just outdated or just an example Seems to be outdated: > [Next page](https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223.md?page=2)