search

rust-secure-code / cargo-supply-chain

Gather author, contributor and publisher data on crates in your dependency graph.
Apache License 2.0
315 stars 18 forks source link

Grab the publisher of the exact version used as dependency #9

Open HeroicKatora opened 3 years ago

HeroicKatora commented 3 years ago

By chance I came across this fact:

https://github.com/rust-lang/crates.io/blob/85bf66e511788523db925410dedc30cf91bb44d1/src/tasks/dump_db/dump-db.toml#L215

Apparently, the information about who published a particular crate version is publicly available in the data dumps. Although that might not have been intended by all crates.io staff.