dpc [I] 12-21 22:56 dpc@futex ~/l/crev (master)> cargo build --release; and ./target/release/cargo-crev crev verify deps
Finished release [optimized] target(s) in 0.20s
Updating crates.io index
unknown 0 0 103716 3055881 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/proc-macro2-0.3.5
unknown 0 0 2179 2455 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/pmac-0.1.0
verified 6 6 452540 8704066 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/log-0.4.6
unknown 0 0 5651 60842 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/derive_builder-0.7.0
verified 3 3 967452 1951348 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/either-1.5.0
unknown 0 0 1335499 1904576 ~/.cargo/registry/src/github.com-1ecc6299db9ec823/fnv-1.0.6
(...)
dpc Now you can see how many crates.io downloads given version/package has.
dpc Like this one https://crates.io/crates/assert
dpc 26 versions, of a crate that has pretty much one function ...
dpc Or this one ... https://crates.io/crates/database
Moongoodboy{K} >when security is a concern, it might not be appropriate; I recommend switching to tempdir
Moongoodboy{K} author admitted it's not good for production use!
Moongoodboy{K} should put that in your crev comment.
Moongoodboy{K} >>docs for ::random::Default
The default source is the Xorshift128+ algorithm.
what the actual…
I'll write some more tests as well.
Without backtraces it is difficult to find the cause, but if you have no idea I can investigate some more.
Dtgr Only a review for my own crate at the moment though. A bit of a learning curve still with crev.
Dtgr Great job by the way, this is something that is definitely needed.
dpc 👍👍👍
dpc I've also updated stuff to newest cargo, so if you do cargo crev verify deps in a new project, there will be nice progress bar etc. when downloading crates automatically. :)
dpc https://users.rust-lang.org/t/cargo-crev-0-2-notes-from-dogfooding-looking-for-automatic-scanning-tools-and-ideas/23480/4?u=dpc any opions about using authorship information?
dpc At very least in cargo crev verify deps we could display crate authorship against a list of trusted authors or something in the summary view. The question is how far to take the whole concept.
dpc Agreed to which parts exactly?
Moongoodboy{K} That particular paragraph that I quoted.
Moongoodboy{K} …not sure if the website has wonky selection blocking, or I just failed to UI somehow. Anyway:
Moongoodboy{K} >>Summing up: ideally, I would like burntsushi to sign reviews of his own (and other) crates, and not have people trust everything just because it says that allegedly it was authored by burntsushi. 🙂
Yeah, agreed.