crev-dev / crev-dev/cargo-crev

Make trust graph consider paths (aka flow).

Open
#45 13 comments 1 reaction 0 assignees View on GitHub
design enhancement
Dominant language
Rust
Stars
2.3k
Forks
97
PR merge metrics
No merged PRs in 30d

Description

This is related to #44 .

Right now WoT graph is build by just a cost-bounded flooding of a graph. This makes it possible for anyone to create a new CrevId, trust it, and this way artificially increase the possible count of reviewes for a given crate.

This algorithm should keep track of path (id(s) of that directly trusted this one), on each step to the root of the trust tree, and so that when calculating the count of reviews, it's possible to "merge" reviews coming out from a common path, for the purpose of calculating the total trust count.

Example: If you directly trust only one other CrevId, you can only have trust count equal to 1, for any given crate, no matter how many people reviewed it.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the WoT graph implementation and the discussion in issue #44, then trace the cost-bounded flooding and review-count calculation. The change is done when trust paths are retained back to the root and reviews from a common path are merged so a single directly trusted CrevId bounds the trust count.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
distributed-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.