Crates.io is at risk of wormable malware

Many years ago I used to publish from CI. I stopped doing that because the number of failures was painful. I think a blocker for that to become a standard practice is having a 100% reliable cargo publish --workspace --dry-run to run as part of normal CI and ensure that your crates are ready to publish before you actually do so. (There are inconsistencies currently as crates.io applies more restrictions to the manifest than cargo does).

2 Likes

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.