thirdpass

I'm working on a tool for collaboratively reviewing Rust crate dependencies: https://github.com/thirdpass-org/thirdpass Also supports npm, PyPI, and Ansible Galaxy.

Hello, The goal of Thirdpass as a service is to coordinate the collaborative review effort necessary to lower software supply-chain risks. Multi-ecosystem support: crates.io, pypi.org, npmjs.com, and galaxy.ansible.com. Thirdpass should enable anyone to review by pointing their spare AI capacity at dependencies. Some thoughts over the years whilst working on this off and on: * A coordination node can add a lot of value. * It's difficult to motivate human reviewers. * A review which adds partial coverage is still valuable. * The supply-chain risk is not unique to JavaScript. This project started in 2021 and was recently revived. I've honestly had a lot of fun working on this. I'm looking for contributors to help build and review. I hope the community finds this valuable! https://github.com/thirdpass-org/thirdpass https://thirdpass.dev/

If you don't know the author, signatures do nothing. Anybody can sign their package with some key. Even if you could check the author's identity, that still does very little for you, unless you know them personally. It makes a lot more sense to use cryptography to verify that releases are not malicious directly. Tools like crev [1], vouch [2], and cargo-vet [3] allow you to trust your colleagues or specific people to review packages before you install them. That way you don't have to trust their authors or package repositories at all. That seems like a much more viable path forward than expecting package repositories to audit packages or trying to assign trust onto random developers. [1]: https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet

I don't think it makes much sense to verify pypi authors. I mean you could verify corporations and universities and that would get you far, but most of the packages you use are maintained by random people who signed up with a random email address. I think it makes more sense to verify individual releases. There are tools in that space like crev [1], vouch [2], and cargo-vet [3] that facilitate this, allowing you to trust your colleagues or specific people rather than the package authors. This seems like a much more viable solution to scale trust. [1]: https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet

Alternatives to cargo-vet that has been mentioned before here on HN: - https://github.com/crev-dev/crev - https://github.com/vouch-dev/vouch Anyone know of any more alternatives or similar tools already available?

Two more alternatives to crev: https://github.com/vouch-dev/vouch https://github.com/mozilla/cargo-vet

Hello megumax! I'm working on a solution along the lines that you've suggested: https://github.com/vouch-dev/vouch Vouch lets users create and share reviews for NPM packages. Project dependencies can then be checked against those reviews. Vouch uses extensions to interface with package ecosystems. Extensions currently exist for NPM, PyPi, and Ansible Galaxy. I'm currently working on a website to index known reviews and publish official reviews. Drop by the Matrix channel if you have any feedback or thoughts to share: #vouch:matrix.org

I've created Vouch in an attempt to address this problem: https://github.com/vouch-dev/vouch Vouch lets users create and share reviews for NPM packages. Project dependencies can then be checked against those reviews. Vouch uses extensions to interface with package ecosystems. It's simple to create a new extension. Extensions currently exist for NPM, PyPi, and Ansible Galaxy. I'm currently working on a website to index known reviews and publish official reviews. I hope you guys find it useful! Drop by the Matrix channel if you have any feedback to share: #vouch:matrix.org