most popular crates not there?
- Dominant language
- Go
- Stars
- 714
- Forks
- 64
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 58
Description
syn and quote are the most downloaded crates: https://crates.io/crates?sort=downloads
One would expect these crates to be covered. How does one go about expanding the range of crates?
```
go run github.com/google/oss-rebuild/cmd/oss-rebuild@latest list cratesio syn nix-shell-env
go: github.com/google/oss-rebuild@v0.0.0-20250722051654-6f57c474a8fa requires go >= 1.23.0; switching to go1.23.11
cratesio/syn-mid/0.5.1/syn-mid-0.5.1.crate/rebuild.intoto.jsonl
cratesio/syn-mid/0.5.2/syn-mid-0.5.2.crate/rebuild.intoto.jsonl
cratesio/syn-mid/0.5.3/syn-mid-0.5.3.crate/rebuild.intoto.jsonl
cratesio/sync_wrapper/0.1.0/sync_wrapper-0.1.0.crate/rebuild.intoto.jsonl
cratesio/sync_wrapper/0.1.1/sync_wrapper-0.1.1.crate/rebuild.intoto.jsonl
cratesio/sync_wrapper/0.1.2/sync_wrapper-0.1.2.crate/rebuild.intoto.jsonl
cratesio/synstructure/0.12.3/synstructure-0.12.3.crate/rebuild.intoto.jsonl
cratesio/synstructure/0.12.4/synstructure-0.12.4.crate/rebuild.intoto.jsonl
cratesio/synstructure/0.12.5/synstructure-0.12.5.crate/rebuild.intoto.jsonl
```
```
go run github.com/google/oss-rebuild/cmd/oss-rebuild@latest list cratesio quote nix-shell-env
go: github.com/google/oss-rebuild@v0.0.0-20250722051654-6f57c474a8fa requires go >= 1.23.0; switching to go1.23.11
cratesio/quoted_printable/0.4.5/quoted_printable-0.4.5.crate/rebuild.intoto.jsonl
cratesio/quoted_printable/0.4.6/quoted_printable-0.4.6.crate/rebuild.intoto.jsonl
cratesio/quoted_printable/0.4.7/quoted_printable-0.4.7.crate/rebuild.intoto.jsonl
cratesio/quoted_printable/0.4.8/quoted_printable-0.4.8.crate/rebuild.intoto.jsonl
cratesio/quoted_printable/0.5.0/quoted_printable-0.5.0.crate/rebuild.intoto.jsonl
```
Contributor guide
Research direction
Start by running the shown `oss-rebuild list cratesio syn` and `oss-rebuild list cratesio quote` commands, then trace how the crates.io package range is selected. Done means the actual `syn` and `quote` crates, rather than only similarly named packages, appear in the listing with their rebuild attestations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, rust
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100