-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add actual git repository for source #98
Comments
The repository URL is deliberately redacted because of privacy concerns raised in the RFC: rust-lang/rfcs#2801 However, we could and probably should include commit hashes for dependencies from git. |
Hm, that's a good point indeed. I guess it depends on ones use case. Adding commit hashes shouldn't be a problem I guess. But would improve the situation. |
Just a thought that just crossed my mind. Why not allow both? If a user has not problem with "leaking" this information, this it can be added. Otherwise, it will be redacted using a hash as you suggested. So the choice is to the person verifying the information if this is good enough or not. |
Including git repo URLs causes privacy issues, but I've opened #122 to track including commit hashes. |
The
Source
information only contains the information what kind of repository/registry was used.This is enough in the case of a dependency from crates.io, but especially for a git dependency, this could mean anything, and doesn't really provide any value IMHO.
Unless of course, the actual repository information (like the git repository + revision) would be available too.
I know this would increase the size of the metadata. However, I also think it would provide quite some value. And, this would only be the case of one would use dependencies from git anyway.
The text was updated successfully, but these errors were encountered: