Tracking unmaintained crates about advisory-db

[RalfJung]

I was mostly saying that it seems odd to call them "maintainers" if they are not maintaining it. Maybe "former maintainers" or so?

[tarcieri]

Just as an added thought, I think the unmaintained.toml, especially when filed by a crate owner, could include some interesting other metadata, like:

Crate `x` is unmaintained: the maintainer suggests using crates `y` or `z`

So even in cases where it doesn't help recruit a new maintainer, it can at least provide people pointers about what they should use instead.

[BurntSushi]

@RalfJung It happens: https://github.com/BurntSushi/chan#this-crate-has-reached-its-end-of-life-and-is-now-deprecated --- Although perhaps you might still consider that maintained since I put the message there.

[tarcieri]

If we ship such a feature, here's a crate we should track:

https://twitter.com/passcod/status/1168188637361725442

[Shnatsel]

I believe rustcrypto crate was also unmaintained but impossible to take down for a good while.

[RalfJung]

Crate x is unmaintained: the maintainer suggests

So it's not maintained but there is a maintainer suggesting something? That sounds funny. ;)

[tarcieri]

See also this recent thread on MP3 crates:

https://rust-audio.discourse.group/t/opportunity-mp3-crate/122/6?u=tarcieri

In it there are authors both willing to transfer ownership of their crates, and also suggesting alternative crates, so I've definitely seen it happen "in the wild".

[porglezomp]

Are you already using the

[badges]
maintenance = { status = "..." }

metadata that can be present in the Cargo.toml? Would it be beneficial to pitch for extra optional keys for that in the case that status = "deprecated"?

[tarcieri]

@porglezomp no, but that's a good point.

After some discussion on this issue, I got to thinking that perhaps a good feature to add is an "informational advisory" which can warn for certain crate revisions, but doesn't fail the audit:

#131 (comment)

We could have various categories of informational advisories, and one of them could be "looking for maintainer"

This would allow us to reuse the same advisory format rather than adding a bespoke new one.