crev-dev / crev-dev/cargo-crev
Make trust graph consider paths (aka flow).
- Dominant language
- Rust
- Stars
- 2.3k
- Forks
- 97
- PR merge metrics
- No merged PRs in 30d
Description
This is related to #44 .
Right now WoT graph is build by just a cost-bounded flooding of a graph. This makes it possible for anyone to create a new CrevId, trust it, and this way artificially increase the possible count of reviewes for a given crate.
This algorithm should keep track of path (id(s) of that directly trusted this one), on each step to the root of the trust tree, and so that when calculating the count of reviews, it's possible to "merge" reviews coming out from a common path, for the purpose of calculating the total trust count.
Example: If you directly trust only one other CrevId, you can only have trust count equal to 1, for any given crate, no matter how many people reviewed it.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the WoT graph implementation and the discussion in issue #44, then trace the cost-bounded flooding and review-count calculation. The change is done when trust paths are retained back to the root and reviews from a common path are merged so a single directly trusted CrevId bounds the trust count.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- distributed-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100