cargo-deny

There is `cargo-deny` that handles some enforcement: https://github.com/EmbarkStudios/cargo-deny. Doesn't handle authors, but I suspect it's easy to add? There is really just a handful of crates that nearly often get pulled in and probably like 5 authors across them. Supply chain harderning is pretty easy in rust: caro-deny, cargo-suply-chain, cargo-crev, cargo-vet, cargo-{s}bom and probably a few more I can't remember.

> Explain the crate scanner thing? I assume a reference to tools that help manage potential issues around dependencies, e.g.: * https://github.com/rustsec/rustsec/tree/main/cargo-audit * https://github.com/EmbarkStudios/cargo-deny "[cargo-audit] Audit Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database." "cargo-deny is a cargo plugin that lets you lint your project's dependency graph to ensure all your dependencies conform to your expectations and requirements." e.g. license, security advisories, source.

For licenses there's cargo-deny https://github.com/EmbarkStudios/cargo-deny On the security standpoint and a wide net of crates.. that's a problem, same as with npm/yarn/pip/whatever and I agree on that. That one bugs me as well. Difficult to audit.

Would be nice if built in, but cargo-deny is a neat project by Embark that can do this: https://github.com/EmbarkStudios/cargo-deny

Added a verification step to prevent this in Rust code with our cargo-deny tool. https://github.com/EmbarkStudios/cargo-deny/pull/80 We run this in GitHub Actions for all of our Rust repos, primarily to prevent banned or duplicate dependencies and approved licenses. But also works for verifying the sources of crates to prevent this specific issue now