I agree with you that we need something different than trusting an entire user and everything that comes from them, and something more like trusting a specific releases.
I think crev is a step in the right direction, but there are some things I don't think they get right which makes it hard to actually be useful in practice. For example, there is no specifics regarding crew understanding files themselves, no easy way of aggregating data, the solution not being scalable for projects using lots of dependencies and some other points.
But rather than just complaining about crev, I've started to build an alternative, that addresses those issues. It's not really ready for showtime yet (it'll be a Show HN once it is :) ), but if this is something people want to help out and collaborate on, I'm happy to share the progress in private for now. If anyone is interested, reach out to me at [email protected] and we can talk more! I'm also currently looking for another full-time/part-time developer to work on the project together with me. Only requirement is some previous experience with Rust, Clojure and ClojureScript, and a burning desire of wanting to fix security in the open source packaging community.
I think crev is a step in the right direction, but there are some things I don't think they get right which makes it hard to actually be useful in practice. For example, there is no specifics regarding crew understanding files themselves, no easy way of aggregating data, the solution not being scalable for projects using lots of dependencies and some other points.
But rather than just complaining about crev, I've started to build an alternative, that addresses those issues. It's not really ready for showtime yet (it'll be a Show HN once it is :) ), but if this is something people want to help out and collaborate on, I'm happy to share the progress in private for now. If anyone is interested, reach out to me at [email protected] and we can talk more! I'm also currently looking for another full-time/part-time developer to work on the project together with me. Only requirement is some previous experience with Rust, Clojure and ClojureScript, and a burning desire of wanting to fix security in the open source packaging community.