Announcing `cargo supply-chain`: Know whom you trust

• cargo-supply-chain

  20 311 4.9 Rust

  Gather author, contributor and publisher data on crates in your dependency graph.

  

• paru

  74 5,459 8.9 Rust

  Feature packed AUR helper

I noticed that running cargo supply-chain publishers on paru results in 78. gentoo90 via crates: winreg, even though winreg is not a dependency of paru on Linux if I run cargo tree. (paru is a Pacman AUR helper, not designed to run on Windows.)

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• crates.io-index

  39 536 10.0 Shell

  Registry index for crates.io

  

The crates.io index published as a git repo does not contain this info either.

• cargo-outdated

  7 1,138 6.7 Rust

  A cargo subcommand for displaying when Rust dependencies are out of date

Some combination of cargo-outdated and cargo-msrv could probably do this in a slightly more manual fashion.

• cargo-msrv

  11 745 9.2 Rust

  🦀 Find the minimum supported Rust version (MSRV) for your project

Some combination of cargo-outdated and cargo-msrv could probably do this in a slightly more manual fashion.

• cargo-crev

  55 2,030 7.9 Rust

  A cryptographically verifiable code review system for the cargo (Rust) package manager.

  

Another similar tool, but geared toward cryptographic web-of-trust code review, is cargo-crev.

Suggest a related project