It would be a shame if you reviewed a bunch of dependencies but the reviews were never used by other people cause they are connected to the wrong registry.
dpc There will probably be nothing forcing the uniqueness, but will that be "best practice" or not.
dpc Reviews are always matched on the digest. At least that's the plan.
dpc Though stuff like displaying reviewes for different versions etc. could be a problem.
dpc But in for these it's OK to loosen the rules about uniqueness anyway, and worst case risk conflating reviewes of different packages, just with the same name.
dpc Probably rare occurence anyway.
dpc Cryptographic digest is the only field that seriously matters. Rest is kind of advisory.
dpc Now, for something completely different: dpc/crev#148 was creating for integratin cargo-gieger to display crates with unsafe. I think for Rust that is going to be of great value.
dpc I guess it's also confusing.
dpc The meaning is: Most of the time reviewed crates are the dependnecies, which makes it easy for crev to auto-guess the version, etc. But sometimes we want to do something for a crate that is not a dependency of a current project.
dpc Funny enough: in crev's case it's mostly crypto crates. :D
but im going to finish it tomorrow, can you wait for that long?
dpc Thank you!
Moongoodboy{K} I mean, I still think --independent should be detected automatically, but okay
dpc --independent has slightly different behavior, and could lead to typos and reviewing different crates
dpc When version argument et is missing for dependency, we take the one that is used in the project. For independent one, we take latest.
dpc So -I would mean that we keep --independent name and give it a short-name?
dpc I guess that's OK solution, though I am not really satisified with independent
dpc --unreleated would carry the meaning better?
Moongoodboy{K} > <@dpc:matrix.org> Moongoodboy{K}: Where is your proof repository? :P
so I started reading the crev source code, and then I decided that I didn't want to do that right then, and I haven't looked at it since
dpc :D
Moongoodboy{K} > <@dpc:matrix.org> When version argument et is missing for dependency, we take the one that is used in the project. For independent one, we take latest.
aha. hmmm.
matrixbot Ekleog still thinks downloading during the signing operation is a proof of bad design, and that as a consequence at least “[f]or independent one, we take latest” is an issue
dpc A big benefit of having a CHANGELOG, is that you can open it and admire the progress. :D https://github.com/dpc/crev/blob/master/cargo-crev/CHANGELOG.md
dpc S/Download/extract/
dpc And you can always generate an id and then throw them away. Noone charges money for them. :D
dpc Dylan DPC (Gitter): I think you've mentioned working on cli integration testing. Anything that you could show? I am tempted to start hacking some basic tests using https://crates.io/crates/assert_cmd