Conflicting info about yanking crates
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
While trying to resolve RUSTSEC-2024-0020, we found some conflicting information (https://github.com/ardaku/whoami/issues/97#issuecomment-1978981489):
- https://github.com/rustsec/advisory-db/blob/main/CONTRIBUTING.md#optional-steps recommends yanking affected crate versions.
- However, https://doc.rust-lang.org/cargo/commands/cargo-yank.html#when-to-yank says to not yank for security issues, and instead to use RustSec.
Which one of these recommendations controls?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the advisory database's CONTRIBUTING.md optional-steps guidance with Cargo's cargo-yank documentation, then review the linked whoami discussion for context. Done means the conflict is resolved with an authoritative recommendation and the relevant guidance is reconciled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100