Crev: dependency vetting with a web of trust
Some background on this:<p>Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is <a href="https://crates.io/crates/left_pad" rel="nofollow">https://crates.io/crates/left_pad</a> if you're wondering).<p>This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware into existing crates, but that still leaves question of trusting the original crate authors.<p>Rust is not a sandbox language. Even the "safe" subset of the language is still just about preventing bugs, but nowhere near a watertight sandbox required to protect programmers and users from straight-up malware running in their own program. It's not clear if that is even possible in an efficient, low-level systems programming language.<p>So the most reasonable way forward is to ensure that all code you use is either from people you trust, or has been verified by you or someone you trust.<p>Turning code reviews into a shareable artifact is a pretty cool addition here, as it reduces duplication of work across the community (you don't have to review everything personally), and helps you pick and choose who you trust.