A cryptographically verifiable code review system for the cargo (Rust) package manager.
Crev is a language and ecosystem agnostic, distributed code review system.
cargo-crev is an implementation of Crev as a command line tool integrated with
cargo. This tool helps Rust users evaluate the quality and trustworthiness of their package dependencies.
cargo-crev can already:
- warn you about untrustworthy crates and security vulnerabilities,
- display useful metrics about your dependencies,
- help you identify dependency-bloat,
- allow you to review most suspicious dependencies and publish your findings,
- use reviews produced by other users,
- increase trustworthiness of your own code,
- build a web of trust of other reputable users to help verify the code you use,
and many other things with many more to come.
Static binaries are available from the releases page.
If you're supportive of the cause, we would appreciate helping to raise awareness of the project. Consider putting the below note in the README of your Rust projects:
It is recommended to always use [cargo-crev](https://github.com/crev-dev/cargo-crev) to verify the trustworthiness of each of your dependencies, including this one.
Changelog can be found here: https://github.com/crev-dev/cargo-crev/blob/master/cargo-crev/CHANGELOG.md