Ownership of Rust crates

[anonrig]

I recently released a Rust crate for Merve and I'm currently the only owner. Ref: https://crates.io/crates/merve

I want to transfer the ownership to @nodejs/tsc or a different team of choosing.

What's the procedure/steps I need to take?

[jasnell]

really just need to propose creation of a new team here. After a week if there are no objections, you create the team. Then it'll just be a matter of recruiting folks to be on it.

[richardlau]

Is it possible to have an account owned by the project on crates.io like we have for npm (the nodejs-foundation user)? I think the main thing is to try to reduce the possibility of the crates being orphaned in the future.

[legendecas]

I think we could create a GitHub org team to be the owner team of the crate package, as documented at https://doc.rust-lang.org/cargo/reference/publishing.html#cargo-owner

[anonrig]

Created a new issue which proposes a new team (just like @jasnell recommended) #1047

Once we create the github team in a couple of days, I can add the github team as the owner of the crate.

[anonrig]

It seems we also need to update Github permissions for Node.js (as documented in https://doc.rust-lang.org/cargo/reference/publishing.html#github-permissions) in order to add TSC as the owner.

cargo owner --add github:nodejs:tsc
    Updating crates.io index
error: failed to invite owners to crate `merve` on registry at https://crates.io

Caused by:
  the remote server responded with an error (status 403 Forbidden): this token does not have the required permissions to perform this action

[richardlau]

SGTM with one point,

https://doc.rust-lang.org/cargo/reference/publishing.html#cargo-owner says

If a team name is given to --add, that team is invited as a “team” owner, with restricted right to the crate. While they have permission to publish or yank versions of the crate, they do not have the ability to add or remove owners.

Which I think generally is a good thing -- i.e. most owners cannot add/remove other owners. But it does lead to asking whether there should also be a project/Foundation controlled user in case we ever do need to change owners beyond the added group?

[anonrig]

OK I've made it work. I've added nodejs/tsc as the owner: https://crates.io/crates/merve

[anonrig]

Which I think generally is a good thing -- i.e. most owners cannot add/remove other owners. But it does lead to asking whether there should also be a project/Foundation controlled user in case we ever do need to change owners beyond the added group?

I agree, we can create a crates.io account and store in 1password (or use OpenJS credentials etc.). I'm more than happy to transfer ownership to whomever TSC seems fit.

[mcollina]

tsc-agenda for visibility

[aduh95]

Is Node.js using https://crates.io/crates/merve? We're using https://github.com/nodejs/merve, which is C++, and IIUC that crate is a Rust wrapper around the C++ lib we're using, correct? Does it make sense for us to own something we're not using?

[legendecas]

Is Node.js using https://crates.io/crates/merve? We're using https://github.com/nodejs/merve, which is C++, and IIUC that crate is a Rust wrapper around the C++ lib we're using, correct? Does it make sense for us to own something we're not using?

It is owning the packages that are maintained on https://github.com/nodejs. Taking npm as an example, https://www.npmjs.com/package/@node-core/caritat is published https://github.com/nodejs/caritat and thus managed by the project.