https://github.com/rust-lang/rfcs/blob/master/text/1242-rust... has some of the motivation behind this.
According to that link, regex is also in the nursery. According to crates.io, regex depends on other crates maintained elsewhere, by a "random" single developer, under a different licenses, with zero obvious guarantees.
https://crates.io/crates/regex
(Regex moved out of the nursery a while back)
The nursery is more of a "These crates are officially blessed and we wish to make them part of rust-lang, unless the community comes up with something better".
The guarantees aren't advertised, they're known. We can do a better job of advertising this, some of the work this year is related to that.
I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this?
Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there.
> The guarantees aren't advertised, they're known.
It is known. -- Jhiqui
Glad to hear improving this is in the works anyway.
That person isn't random; they're on the libs team and the primary author of regex. (there are a few crates by other people as well, but most of those crates were extracted from regex as they can be useful on their own.)
I think it would be important to include in this pledge:
* Transitive closure rule. (No external dependencies not covered by the pledge. Possibly with certain exceptions e.g. for bindings to big known obvious third party dependencies like SQL databases or Operating Systems.)
* Uniform licensing rule. (Everything must use the exact same license, with a single group name as copyright holders and for any purposes of required notices etc.)
* Maintenance, backward compatibility and platform compatibility rule. (100% compatibility forever everywhere is not even necessary, but an _explicit_ rule of thumb of what reasonable time frames for deprecation windows and recommended transition plans can be expected would be nice.)
Or maybe this already exists and I'm just uninformed?
* Are guaranteed to work correctly on all platforms where the language works.
* Will always work with the latest stable release of the language.
* Will be available under one single permissive license (with a single copyright holder (body) for any purposes of required notices etc.)
* Will be supported (security patches, bug fixes, etc.) with backward compatibility, more or less indefinitely (with reasonable long time frames for deprecation windows and recommended transition plans etc.)
* Are under no danger of being abandoned simply due to lost interest of the author.
* Crucial: Will only depend on other code in the standard library. (So all these guarantees are transitive!)
And anything that's not in the standard library usually implies there are no such guarantees. This is immensely more helpful and important than the comparatively trivial ease-of-installation.
If the Rust team really does explicitly extend such guarantees to non-standard library crates, that should be clearly and widely communicated. So far the focus seems more on how small the standard library is. What's the advantage for the language user? I see advantages for the Rust team, and mainly I see disadvantages for the (professional) language user. Easy-to-use cargo is nice (especially for casual language users) but is nowhere close to really making up for that.