I put together a blog post for the call for Rust 2019 posts. Let me know what you think.
4 Likes
Very good article!
Beyond tracking we need people to develop tools. Anything that brings in more developers increases the pool of potential volunteers and should be a priority. Similarly anything that makes it easier and faster to create and distribute high quality crates will provide long term dividends.
I was wondering, do you have any specific additional tools in mind here?
Some sort of verification that crates uploaded to Crates.io are the same as what is visible in github what reviewers saw. The easiest way to do this might be to have Crates.io pull directly from github/gitlab/etc. This would also make version tracking transparent.
I've been thinking about this lately, and I've been wondering if it would make sense to add some crate content inspection functionality to crates.io. Having it available there would untangle it from any chosen version control system or hosting platform. Plus it would be nice to build from that, with actual unsafe-occurences tracking, and things like calculating diffs for changes across versions. It's something I use regularly on CPAN.
Some sort of verification that crates uploaded to Crates.io are the same as what is visible in github what reviewers saw. The easiest way to do this might be to have Crates.io pull directly from github/gitlab/etc. This would also make version tracking transparent.
Crates.io currently doesn't require that package authors use any code hosting, let alone particular ones. There would be complaints about changing that requirement, and we would never be able to get online source control links for currently existing versions. Also, that "etc" of the sites we'd need to support would be a fragile long tail.
docs.rs allows you to inspect crate source; for example, here's the source of lazy_static 1.2.0.
Ah, I wasn't aware it provided full inspection of the crate contents, thanks!
and things like calculating diffs for changes across versions.
There's already a tool for that:
We can create a feature without making it mandatory. Additionally we don't have to tie it to just one hosting platform, being plugable would help companies with internal repos. I think a fair number of crates would take advantage of such a feature if it were available.