It’s not just web dev: go, rust, swift, ruby, python none of them do any checking.
In fact the only repo I know of doing any checking is Java’s Maven/Sonotype and it’s automated not manual.
In fact the only repo I know of doing any checking is Java’s Maven/Sonotype and it’s automated not manual.
Goes the same for almost all packages in all distros though.
I’d say most of us have some connection to what we’re packaging but there are plenty of hastily approved and merged “bump to version x” commits happening.
Official packages for the nixpkgs cache are built/compiled on Nix's own infrastructure, not by the maintainers, so you can't just sneak malicious code in that way without cracking into the server.
What package maintainers do is contribute these build instructions, called derivations. Here's an example for a moderately complex one:
https://github.com/NixOS/nixpkgs/blob/master/pkgs/applicatio...
https://github.com/NixOS/nixpkgs/blob/master/pkgs/applicatio...
As you can see, you can include a patch to the source files, add custom bash commands to be executed and you can point the source code download link to anywhere you want. You could do something malicious in any of these steps, but I expect the reviewer to at least look at it and build it locally for testing before committing, in addition to any other interested party.
I don't think this would be viable if the OCaml community grew larger though.
Painless package management is a good thing. Central package repositories without any checking isn't. You don't have to throw away the good because of the bad.
There's a reason why these things come hand in hand, though. If the package management is so painless that everyone is creating packages, then who is going to pay for the thoroughly checked central repository? And if you can't fund a central repository, how do you get package management to be painless?
The balance that most language ecosystems seem to land on is painless package management by way of free-for-all.
You could host your own package server with your own packages, and have the painless package manager retrieve these painlessly.
Of course we're in this situation because people want to see the painlessness with what other people built. But other people includes malicious actors every once in a while.
I'm looking at rust, and that it doesn't work well with our package manager (and our rules for review) is one of the big negatives!
Note, if you want to do the above just use Conan. We wrote our package manager before Conan existed, and it isn't worth replacing, but it isn't worth maintaining our own. What is important is that you can enforce your review rules in the package manager not what the package manager is.