I&#x27;d like to echo the author in that Cargo is the best language package manager&#x2F;build system I&#x27;ve had the pleasure to use.<p>However, there is one serious problem with Cargo&#x27;s packages: They simply aren&#x27;t authenticated. Cargo&#x27;s developers acknowledge this issue and there is a proposal to amend it by adopting the TUF [1]. but this issue doesn&#x27;t seem to enjoy the attention it deserves.<p>As a person living in a country that increasingly edging towards going the Kazakhstan route where all secure traffic will be MITMed, simply relying on transport security as a way to secure crates is not sufficient. and that&#x27;s ignoring compromises due to server security failures. At present, my only options are to include the entire dependency tree in crate or avoid dependencies altogether.<p>Even ignoring my problem (which wouldn&#x27;t effect a large number of rust developers), Mixing transport security with authentication and integrity shouldn&#x27;t happen in vital infrastructure like a language package system.<p>There are other problems like not representing system libraries that a crate depends on in the project manifest, but unauthenticated crates are a ar more serious problem.<p>[1]:<a href="https:&#x2F;&#x2F;github.com&#x2F;rust-lang&#x2F;crates.io&#x2F;issues&#x2F;75" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rust-lang&#x2F;crates.io&#x2F;issues&#x2F;75</a>