37
crates.io Postmortem: Broken Crate Downloads
(blog.rust-lang.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 28 Jul 2023
37 points (97.4% liked)
Rust
6035 readers
8 users here now
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Wormhole
Credits
- The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)
founded 1 year ago
MODERATORS
True, code for critical IT infrastructure should always be reviewed. But from what I understand, this is difficult because there is one full-time developer (paid by the Rust Foundation) and a small number of volunteers, who don't have the time to review all the employee's changes.
Easy solution, give review rights to a few volunteers. Pick from the regular contributors.
On GitHub, everybody has the ability to review pull requests, even you. But there still aren't enough volunteers who review PRs.
Sure, but you should always have a core contributor required to review code before it gets merged. That's a feature GitHub offers, and it should be used. Block all PRs unless there's at least one review from a trusted contributor, and consider requiring a second review from any source.
That doesn't solve the issue that there are too few contributors. Requiring a review doesn't ensure that someone reviews the code.
Requiring a review from a trusted contributor ensures that one of those trusted contributors reviews the code. The one main maintainer should add more people to that trusted circle, which will ensure that at least one of those will review all code that goes into the codebase.
If people see that code isn't being merged, someone will step up to request to be in that trusted circle.