Skip to content

Commit ed88f70

Browse files
Turbo87Turbo87
committed
Add "crates.io Policy Update" RFC
1 parent ed4c592 commit ed88f70

File tree

1 file changed

+225
-0
lines changed

1 file changed

+225
-0
lines changed

‎text/0000-crates-io-policy-update.md‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
- Start Date: 2023-07-24
2+
- RFC PR: [rust-lang/rfcs#0000](https://github.com/rust-lang/rfcs/pull/0000)
3+
4+
# Summary
5+
[summary]: #summary
6+
7+
The Rust community has outgrown the current crates.io policies. This RFC proposes a new "Terms of Use" policy based on prior work by PyPI, npm and GitHub.
8+
9+
# Motivation
10+
[motivation]: #motivation
11+
12+
> Why are we doing this? What use cases does it support? What is the expected outcome?
13+
14+
crates.io has a "[Package Policies](https://crates.io/policies)" page, which describes the current, organically grown policies. A lot of support requests or questionable uses of crates.io however need explicit decisions from the crates.io team, since many cases are currently not covered by these policies. Additionally, decisions made by the team may be seen as arbitrary without written guidelines.
15+
16+
The situation around name squatting has lately also reached unsustainable levels, and while [namespaces](https://github.com/rust-lang/rfcs/pull/3243) might help with some parts of the problem we would still need policies for name squatting namespaces then.
17+
18+
The main motivation for this RFC is to give the crates.io team a fixed set of rules to determine if a project is using crates.io in a reasonable way, or if the user should get a warning and the project potentially be removed. It is mostly codifying the existing practices of the team, except for being more strict regarding name squatting.
19+
20+
# Proposal
21+
[guide-level-explanation]: #guide-level-explanation
22+
23+
The following is a proposed new "Terms of Use" policy for crates.io, replacing <https://crates.io/policies> and <https://crates.io/data-access>.
24+
25+
-------------------------------------------------------------------------------
26+
27+
# Terms of Use
28+
29+
**Short version:** _crates.io is a critical resource for the Rust ecosystem,
30+
which hosts a variety of packages from a diverse group of users. That resource
31+
is only effective when our users are able to work together as part of a
32+
community in good faith. While using crates.io, you must comply with our
33+
Acceptable Use Policies, which include some restrictions on content and conduct
34+
on crates.io related to user safety, intellectual property, privacy,
35+
authenticity, and other limitations. In short, be excellent to each other!_
36+
37+
We do not allow content or activity on crates.io that:
38+
39+
- violates the [Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct)
40+
of the Rust project
41+
- is unlawful or promotes unlawful activities
42+
- is libelous, defamatory, or fraudulent
43+
- amounts to phishing or attempted phishing
44+
- infringes any proprietary right of any party, including patent, trademark,
45+
trade secret, copyright, right of publicity, or other right
46+
- unlawfully shares unauthorized product licensing keys, software for
47+
generating unauthorized product licensing keys, or software for bypassing
48+
checks for product licensing keys, including extension of a free license
49+
beyond its trial period
50+
- contains malicious code, such as computer viruses, computer worms, rootkits,
51+
back doors, or spyware, including content submitted for research purposes
52+
(tools designed and documented explicitly to assist in security research are
53+
acceptable, but exploits and malware that use the crates.io registry as a
54+
deployment or delivery vector are not)
55+
- uses obfuscation to hide or mask functionality
56+
- is discriminatory toward, harasses or abuses another individual or group
57+
- threatens or incites violence toward any individual or group, especially on
58+
the basis of who they are
59+
- is using crates.io as a platform for propagating abuse on other platforms
60+
- violates the privacy of any third party, such as by posting another person's
61+
personal information without consent
62+
- gratuitously depicts or glorifies violence, including violent images
63+
- is sexually obscene or relates to sexual exploitation or abuse, including of
64+
minors
65+
- is false, inaccurate, or intentionally deceptive information and likely to
66+
adversely affect the public interest (including health, safety, election
67+
integrity, and civic participation)
68+
- is off-topic, or interacts with platform features in a way that significantly
69+
or repeatedly disrupts the experience of other users
70+
- exists only to reserve a name for a prolonged period of time without having
71+
any genuine functionality or significant development activity on the
72+
corresponding repository
73+
- is related to buying, selling, or otherwise trading of package names or any
74+
other names on crates.io for money or other compensation
75+
- impersonates any person or entity, including through false association with
76+
crates.io, or by fraudulently misrepresenting your identity or site's purpose
77+
- is related to inauthentic interactions, such as fake accounts and automated
78+
inauthentic activity
79+
- is using our servers for any form of excessive automated bulk activity, to
80+
place undue burden on our servers through automated means, or to relay any
81+
form of unsolicited advertising or solicitation through our servers, such as
82+
get-rich-quick schemes
83+
- is other automated excessive bulk activity and coordinated inauthentic
84+
activity, such as
85+
- spamming
86+
- cryptocurrency mining
87+
- is not functionally compatible with the cargo build tool (for example, a
88+
"package" cannot simply be a PNG or JPEG image, a movie file, or a text
89+
document uploaded directly to the registry)
90+
- is abusing the package index for purposes it was not intended
91+
92+
You are responsible for using crates.io in compliance with all applicable laws,
93+
regulations, and all of our policies. These policies may be updated from time to
94+
time. We will interpret our policies and resolve disputes in favor of protecting
95+
users as a whole. The crates.io team reserves the possibility to evaluate each
96+
instance on a case-by-case basis.
97+
98+
For issues such as DMCA violations, or trademark and copyright infringements,
99+
the crates.io team will respect the legal decisions of the
100+
[Rust Foundation](https://rustfoundation.org/) as the official legal entity
101+
providing the crates.io service.
102+
103+
104+
## Package Ownership
105+
106+
crates.io has a first-come, first-serve policy on crate names. Upon publishing a
107+
package, the publisher will be made owner of the package on crates.io.
108+
109+
If you want to take over a package, we require you to first try and contact the
110+
current owner directly. If the current owner agrees, they can add you as an
111+
owner of the crate, and you can then remove them, if necessary. If the current
112+
owner is not reachable or has not published any contact information the
113+
crates.io team may reach out to help mediate the process of the ownership
114+
transfer.
115+
116+
The crates.io team only deletes crates from the registry that do not comply with
117+
the policies on this document. Crate deletion by their owners is not possible to
118+
keep the registry as immutable as possible. If you want to flag your crate as
119+
open for transferring ownership to others, you can publish a new version with
120+
a message in the README or description communicating to the crates.io support
121+
team that you consent to transfer the crate to the first person who asks for it:
122+
123+
> I consent to the transfer of this crate to the first person who asks
124+
> [email protected] for it.
125+
126+
127+
## Data Access
128+
129+
If you need access to a large subset of the crates.io database we recommend
130+
first looking at the **crates.io [index repository](https://github.com/rust-lang/crates.io-index)**.
131+
This repository is updated live whenever new versions are published and contains
132+
all the information needed for cargo to run the dependency resolution algorithm.
133+
134+
In case the index dataset is insufficient for your purposes, we also publish a
135+
**database dump** every 24 hours. This includes the majority of data from our
136+
database except for sensitive private information. The latest database dump is
137+
available at <https://static.crates.io/db-dump.tar.gz> and information on using
138+
the content is contained in the tarball. Please note that while we aim to keep
139+
the data structure somewhat stable, we can not give any stability guarantees on
140+
the exact database table layouts.
141+
142+
If the index repository and the database dump are insufficient you may also use
143+
the crates.io API directly, though it is at the discretion of the crates.io to
144+
block any excessive usage. We require users of the crates.io API to limit
145+
themselves to a maximum of 1 request per second.
146+
147+
We also require all API users to provide a user-agent header that allows us to
148+
uniquely identify your application. This allows us to more accurately monitor
149+
any impact your application may have on our service. Providing a user agent that
150+
only identifies your HTTP client library (such as `request/0.9.1`) increases the
151+
likelihood that we will block your traffic.
152+
153+
It is recommended, to include contact information in your user-agent header:
154+
155+
- Bad: `User-Agent: reqwest/0.9.1`
156+
- Better: `User-Agent: my_bot`
157+
- Best: `User-Agent: my_bot (my_bot.com/info)` or `User-Agent: my_bot (help@my_bot.com)`
158+
159+
This allows us to contact you if we would like a change in your application's
160+
behavior without having to block your traffic.
161+
162+
We reserve the right to block traffic from any client that we determine to be in
163+
violation of this policy or causing an impact on the integrity of our service.
164+
165+
166+
## Security
167+
168+
Safety is one of the core principles of Rust, and to that end, we would like to
169+
ensure that cargo and crates.io have secure implementations. To learn more about
170+
disclosing security vulnerabilities, please reference the
171+
[Rust Security policy](https://www.rust-lang.org/policies/security) for more
172+
details.
173+
174+
Thank you for taking the time to responsibly disclose any issues you find.
175+
176+
177+
## Violations and Enforcement
178+
179+
crates.io retains full discretion to take action in response to a violation of
180+
these policies, including account suspension, account termination, or removal of
181+
content.
182+
183+
We will however not be proactively monitoring the site for these kinds of
184+
violations, but instead relying on the community to draw them to our attention.
185+
186+
While the majority of interactions between individuals in the Rust community
187+
falls within our policies, violations of those policies do occur at times.
188+
When they do, the crates.io team may need to take enforcement action to address
189+
the violations. In all cases, these actions are permanent and there is no basis
190+
to reverse a moderation action taken by the crates.io team.
191+
192+
193+
## Credits & License
194+
195+
This policy is partially based on [PyPI’s Acceptable Use Policy](https://github.com/pypi/warehouse/blob/3c404ada9fed7a03bbf7c3c74e86c383f705d96a/policies/acceptable-use-policy.md)
196+
and modified from its original form.
197+
198+
Licensed under the [Creative Commons Attribution 4.0 International
199+
license](https://creativecommons.org/licenses/by/4.0/).
200+
201+
-------------------------------------------------------------------------------
202+
203+
# Prior art
204+
[prior-art]: #prior-art
205+
206+
As the "Credits & License" says, the main inspiration for the proposed policy is the [Acceptable Use Policy](https://pypi.org/policy/acceptable-use-policy/) of the Python Package Index (PyPI). Their policy in turn is based on the [Acceptable Use Policies](https://docs.github.com/en/site-policy/acceptable-use-policies/) of GitHub. Both of these policies are licensed under the [Creative Commons Attribution 4.0 International license](https://creativecommons.org/licenses/by/4.0/), so we can happily reuse them.
207+
208+
[PEP 541](https://peps.python.org/pep-0541/) (Python Enhancement Proposal) was also mixed into the document above, specifically the [Invalid Projects](https://peps.python.org/pep-0541/#invalid-projects) section.
209+
210+
The third source of material are the "[Open-Source Terms](https://docs.npmjs.com/policies/open-source-terms)" from npm, from which a few more rules on "Acceptable Content" were imported.
211+
212+
RubyGems, Maven Central, Packagist (PHP) and Nuget (C#) were also investigated, but they did not appear to have written rules published in easy-to-find places.
213+
214+
215+
# Unresolved questions
216+
[unresolved-questions]: #unresolved-questions
217+
218+
- Is the wording of the "name reservation" clause sufficient to discourage name squatting in the future?
219+
- Are there any current legitimate uses of crates.io that would suddenly be forbidden by these new rules?
220+
221+
# Future possibilities
222+
[future-possibilities]: #future-possibilities
223+
224+
- [PEP 541](https://peps.python.org/pep-0541/) also defines rules for abandoned projects and how people could continue maintenance for them. Introducing something like that would be a large deviation for crates.io though, and something that would need a dedicated RFC. Nevertheless, it is worth thinking about if the majority of the Rust community would prefer having such a ruleset.
225+
-

0 commit comments

Comments
 (0)