cargo-crev mit Homebrew, apk, Nix, pacman installieren

Projektlinks

• Homepage
• Upstream-Dokumentation
• Paketmanager-Seite

Befehle und Aliase

• cargo-crev

Projektgeschichte

The repository was created in 2018 and the README describes Crev as a language- and ecosystem-agnostic distributed code-review system. cargo-crev is the Cargo-integrated command-line implementation for Rust users.

Early project history is tied to the dpc/crev lineage; later changelog entries and repository organization show the project under crev-dev/cargo-crev, with continued releases and documentation for trust, package review, verification, and proof repositories.

Adoptionsgeschichte

cargo-crev emerged during growing Rust concern over transitive dependency trust and supply-chain review. Its adoption is more cultural than universal: the README asks supportive projects to recommend it, while package-manager availability in apk, Homebrew, Nix, and pacman makes it accessible to security-minded developers.

The tool has remained active through 2026. The changelog records later features such as exporting toward cargo-vet workflows and AI-assisted review-loop commands, showing that it continues to adapt to Rust supply-chain review practice.

Wie es verwendet wird

Users initialize an identity and proof repository, review crates, publish signed proofs, fetch other users' proofs, and run verification commands against project dependencies. The tool can warn about untrustworthy crates, report dependency metrics, and help identify dependency bloat.

Unlike scanners that only consume centralized advisories, cargo-crev is built around human review statements and trust delegation. That makes it useful when a team wants auditable social trust, not only vulnerability matching.

Warum Paket-Nerds sich dafür interessieren

cargo-crev is one of the Rust ecosystem's most explicit attempts to make package trust a first-class artifact. It treats reviews as distributed, cryptographically verifiable package metadata rather than comments trapped in a website or issue tracker.

For package-history work, it is important because it documents an alternative path for supply-chain security: reviewer reputation, signed proofs, and webs of trust alongside registries and vulnerability databases.

Zeitleiste

• 2018: GitHub repository created.
• 2018: crates.io records the first cargo-crev publication.
• 2022: Changelog records proof storage moving toward data directories and new web-of-trust diagnostics.
• 2025: Changelog records crevette export support toward cargo-vet.
• 2026: Changelog records 0.27.x releases adding AI review-loop commands and Rust 2024 edition work.

Related projects

• Crev is the ecosystem-agnostic distributed code-review system that cargo-crev implements for Cargo.
• cargo-vet is a related Rust supply-chain review tool, and the cargo-crev changelog mentions crevette export support toward cargo-vet.
• RustSec-style advisory databases address vulnerability matching, while cargo-crev focuses on signed human trust and review proofs.

Quellen

• https://api.github.com/repos/crev-dev/cargo-crev
• https://crates.io/api/v1/crates/cargo-crev
• https://github.com/crev-dev/cargo-crev/blob/main/cargo-crev/CHANGELOG.md
• https://github.com/crev-dev/cargo-crev/blob/main/cargo-crev/README.md