search

opensource-observer / oso

Measuring the impact of open source software
https://opensource.observer
Apache License 2.0
71 stars 16 forks source link

Validate crates package ownership #2381

Open ryscheng opened 3 hours ago

ryscheng commented 3 hours ago

What is it?

If a user enters a crate into oss-directory, we should validate ownership first in our GitHub app.

We can either use the Crates API here https://doc.rust-lang.org/cargo/reference/registry-web-api.html#owners

Or if we need to, we can use a database dump in our BQ https://github.com/opensource-observer/oso/issues/2380

ryscheng commented 3 hours ago

FYI, the API is rate limited to 1 request per second https://crates.io/data-access

They aggressively block if you abuse