For me it is the crates not having something like a namespace.
Something like this: @org/axum @user/axum
Something like this: @org/axum @user/axum
They should have just copied the Maven Central mode of operation, it has matured over many years and works well, without any drama such as NPM is infamous for.
1) using registered domains as namespace (if one exists)
2) proving that you have access to said domain
This is how Maven does it and it works very well.
I don't see a reason you couldn't use exisiting org/username from Github as namespace, can they squat on it? Not unless they steal it, in which case, Github should be notified.
In that case just yank all versions on Ygg2/stuff, and the any change update from then on references Org/stuff.
* rust-lang/semver
* steveklabnik/sevmer
* dtolnay/semver
That everyone didn't need to do "yank everything, change all cargo.tomls" is a huge advantage of not being tied to this.
If you want a more complex solution, then you would need a more complex index of ownership for cargo. E.g. alias or transfer ownership. It could be as simple as displaying "This crate is deprecated use org/crate instead". Or as complex as what crate is no longer valid.
One needs to know what exactly are cargo namespace requirements?
> Yes. For example, the semver package has lived in these places:
Sure, and squatters squatted over many crate name extorting bribes to release them.
IMO the solution is simpler. Heavily rate limit the creation of namespaces. That's less viable for crate names, but it should be very uncommon to create more than a few namespaces. You could give people a low number that aren't rate limited, like 5, and then rate limit them to 2 a day afterwards.
They can then publish unlimited crates under those namespaces.