But if no other crate depends on your crate and nobody directly uses it, why would any CI system download it?

I think some of the CI systems just monitor all published crates. For example, docs.io potentially pulls it to see if there is any new documentation

So someone could reserve all the pronounceable crate names?

Yeah, it’s a known problem in the (non-namespaced) crates.io ecosystem. If someone else wants this name for their Bluetooth LE crate, I’ll happily hand over the keys, but obviously not every crate-squatter is so principled

Wonder if someone has an internal crate named the same, but yours is getting pulled down for some tertiary use (license check, etc).

Stuff like Docker that defaults to downloading things from Internet repos is kinda scary. There isn’t always a clear dividing line between the thing as a “tool” and the thing as a “repo”.

At least with “git”, I know they I’m not going to end up cloning an artifact from an Internet repo just because I made a small typo…