I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this?
Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there.
> The guarantees aren't advertised, they're known.
It is known. -- Jhiqui
Glad to hear improving this is in the works anyway.
I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this?
Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there.
> The guarantees aren't advertised, they're known.
It is known. -- Jhiqui
Glad to hear improving this is in the works anyway.