What it is
cargo-crev is a command line tool for the Rust package manager ecosystem. It implements Crev, a distributed code review system that is language and ecosystem agnostic, as a cargo subcommand. The project is written in Rust and licensed under Apache-2.0. It is listed under Developer Tools / Version Control & Collaboration.
The concrete problem it addresses is dependency trust. Rust projects often depend on many crates, and users need help deciding which dependencies are safe, which need review, and which have been reviewed by others. cargo-crev helps users warn about untrustworthy crates and security vulnerabilities, display metrics about dependencies, identify dependency bloat, review suspicious dependencies, publish findings, use reviews from other users, increase trustworthiness of their own code, and build a web of trust. The repository lists 2334 stars, 96 forks, and 52 open issues.
Key capabilities
- It warns users about untrustworthy crates and security vulnerabilities.
- It displays useful metrics about a project's dependencies.
- It helps identify dependency bloat in a cargo project.
- It lets users review suspicious dependencies and publish their findings.
- It lets users consume reviews produced by other users.
- It helps users increase the trustworthiness of their own code.
- It supports a web of trust for reputable users who help verify code.
Who uses it and how
- Rust developers use it to evaluate the quality and trustworthiness of package dependencies.
- Security-minded users use it to find untrustworthy crates and vulnerability warnings.
- Maintainers use it to review suspicious dependencies and publish findings for others.
- Users use reviews from other people to reduce the amount of manual inspection needed.
- Participants build a web of trust and may add a recommended README note asking users to verify dependencies with cargo-crev.
Getting started
Static binaries are available from the releases page. The Getting Started Guide, docs.rs documentation, and GitHub discussions provide setup and help.
When to use it — and when not to
Use cargo-crev when a Rust project needs a cryptographically verifiable way to evaluate and share trust in cargo dependencies. It is useful when dependency metrics, vulnerability warnings, published reviews, and a web of trust matter. Do not expect a finished product: the README describes it as a work in progress, and the open issue count shows ongoing development.
project readme (upstream, from github) — read inline
image credit
cargo-crev
A cryptographically verifiable code review system for the cargo (Rust)
package manager.
Introduction
Crev is a language and ecosystem agnostic,
distributed code review system.
cargo-crev is an implementation of Crev as a command line tool integrated with
cargo. This tool helps Rust users evaluate the quality and trustworthiness of
their package dependencies.
Features
cargo-crev can already:
- warn you about untrustworthy crates and security vulnerabilities,
- display useful metrics about your dependencies,
- help you identify dependency-bloat,
- allow you to review most suspicious dependencies and publish your findings,
- use reviews produced by other users,
- increase trustworthiness of your own code,
- build a web of trust of other reputable users to help verify the code you use,
and many other things with many more to come.
Getting started
Static binaries are available from the releases
page.
Follow the cargo-crev - Getting Started
Guide
(more documentation available on docs.rs).
cargo-crev is a work in progress, but it should be usable at all times.
Use discussions
to get help, more information and report feedback. Thank you!
Raise awareness
If you're supportive of the cause, we would appreciate helping to raise
awareness of the project. Consider putting the below note in the README of your
Rust
projects:
It is recommended to always use [cargo-crev](https://github.com/crev-dev/cargo-crev)
to verify the trustworthiness of each of your dependencies, including this one.
Thank you!
Changelog
Changelog can be found here: