55
Could rust do with a crates.io alternative?
(programming.dev)
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Credits
Yes, I'm saying that adding a namespace would require a key, and all releases would be signed with that key. That works similarly to installing a separate repo in a Linux distro, you'd import the key and mark it as trusted, and then signatures would be verified for each download.
So yes, only the initial cargo add would be "dangerous," and there would be a prompt for the user to verify that they have the right key (which they could verify on the project homepage).