Crev: dependency vetting with a web of trust

Re:Crev: dependency vetting with a web of trust by mindB on Friday January 04, 2019 @01:24PM (#18826351)

Could you elaborate on what you mean by this? Were you wanting people to be able to publish proofs that they've reviewed the legal standing of the code as well as the code itself for problems?

[ Parent | on HN ]

Re:Crev: dependency vetting with a web of trust by fiddlerwoaroof on Friday January 04, 2019 @01:32PM (#18826446)

It would be useful to know if the MIT library you’re depending on pulls in a AGPL transitive dependency.

[ Parent | on HN ]

Re:Crev: dependency vetting with a web of trust by mindB on Friday January 04, 2019 @04:09PM (#18827646)

I don't see how a cryptographic WoT system is necessary for that kind of concern. That sounds like more tooling needed around the language's basic packaging system.

[ Parent | on HN ]

Re:Crev: dependency vetting with a web of trust by alexchamberlain on Friday January 04, 2019 @01:37PM (#18826473)

Yeah. For example, the original author could declare they own the copyright on xyz release and its released under a certain licence

[ Parent | on HN ]

Re:Crev: dependency vetting with a web of trust by wyldfire on Friday January 04, 2019 @01:41PM (#18826504)

That's stipulated by the crate metadata and the only authority of that claim is the author's, right? Why would you want/need bolstering of that claim by a web-of-trust? What would it mean if the WoT identified a different copyright owner than the author or a different license from the one the author offers?

[ Parent | on HN ]