Skip to main content

I took the list of #Rustlang packages in Debian, and converted it to cargo-vet audits, so you can use "Debian-approved" dependencies without depending on Debian.

https://salsa.debian.org/rust-team/debcargo-conf/-/tree/master/src

https://raw.githubusercontent.com/kornelski/crev-proofs/HEAD/debian.toml

https://mozilla.github.io/cargo-vet/importing-audits.html

https://lib.rs/crates/want/audit


src · master · Rust compiler tools and packages / debcargo-conf · GitLab

debcargo configs and overrides for all rust packages
GitLab
#rustlang
This entry was edited (10 months ago)
silwol
silwol  
•
Nice! Just one hint you might consider: not all content of that repository directly maps to a package in Debian. Some haven't been uploaded yet, some have been uploaded but not yet accepted, and for some crates we created faulty directories with information about not packaging them in order to prevent accidental uploads. A more reliable source might be searching for source packages starting with `rust-` in http://deb.debian.org/debian/dists/bookworm/main/source/Sources.gz and its equivalent in other components.
Kornel
Kornel  
•

I'm ignoring ones with a BLOCK file and TOML syntax errors. https://docs.rs/index-debcargo/latest/src/index_debcargo/lib.rs.html#183
Are there other cases where there could be unreviewed/unapproved items in the debcargo-conf repo?

edit: I've added cross-check against Sources.gz and excluded "UNRELEASED*" distro name.

lib.rs - source

Source of the Rust file `src/lib.rs`.
docs.rs
This entry was edited (10 months ago)
silwol
silwol  
•
Sorry for the late response. Although I assume there could be some edge cases that might slip through, this looks like a rather solid check. The only open topic I can think of is that you might be missing out on some packages that are not maintained in the https://salsa.debian.org/rust-team/debcargo-conf repository, but somewhere else. I don't remember exactly which crates that are, I just remember that they exist.
This entry was edited (10 months ago)
⇧