Skip to content

Commit dcf383b

Browse files
Turbo87Turbo87
committed
Integrate "crates.io Policy Update" RFC
see rust-lang/rfcs#3463
1 parent a8fb349 commit dcf383b

File tree

3 files changed

+150
-147
lines changed

3 files changed

+150
-147
lines changed

‎app/components/footer.hbs

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<div>
2323
<h1>Policies</h1>
2424
<ul role="list">
25-
<li><LinkTo @route="policies">Package Policies</LinkTo></li>
25+
<li><LinkTo @route="policies">Usage Policy</LinkTo></li>
2626
<li><a href="https://www.rust-lang.org/policies/security">Security</a></li>
2727
<li><a href="https://foundation.rust-lang.org/policies/privacy-policy/">Privacy Policy</a></li>
2828
<li><a href="https://www.rust-lang.org/policies/code-of-conduct">Code of Conduct</a></li>

‎app/templates/data-access.hbs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<PageHeader @title="Accessing crates.io data" />
1+
<PageHeader @title="Data Access Policy" />
22

33
<p>
44
crates.io provides several ways of accessing crate data and metadata,

‎app/templates/policies.hbs

+148-145
Original file line numberDiff line numberDiff line change
@@ -1,162 +1,165 @@
1-
<PageHeader @title="Crates.io Package Policies" />
2-
3-
<p>
4-
In general, these policies are guidelines. Problems are often contextual, and
5-
exceptional circumstances sometimes require exceptional measures. We plan to
6-
continue to clarify and expand these rules over time as new circumstances
7-
arise. If your problem is not described below, consider
8-
<a href='mailto:[email protected]'>sending us an email</a>.
9-
</p>
10-
11-
<h2 id='package-ownership'><a href='#package-ownership'>Package Ownership</a></h2>
12-
13-
<p>
14-
We have a first-come, first-served policy on crate names. Upon publishing a
15-
package, the publisher will be made owner of the package on Crates.io.
16-
</p>
17-
18-
<p>
19-
If someone wants to take over a package, and the previous owner agrees, the
20-
existing maintainer can add them as an owner, and the new maintainer can remove
21-
them. If necessary, the team may reach out to inactive maintainers and help
22-
mediate the process of ownership transfer.
23-
</p>
24-
25-
<p>
26-
Using an automated tool to claim ownership of a large number of package names
27-
is not permitted. We reserve the right to block traffic or revoke ownership
28-
of any package we determine to have been claimed by an automated tool.
29-
</p>
30-
31-
<h2 id='removal'><a href='#removal'>Removal</a></h2>
32-
33-
<p>
34-
Many questions are specialized instances of a more general form: “Under what
35-
circumstances can a package be removed from Crates.io?”
36-
</p>
37-
38-
<p>
39-
The short version is that packages are first-come, first-served, and we won’t
40-
attempt to get into policing what exactly makes a legitimate package. We will
41-
do what the law requires us to do, and address flagrant violations of the Rust
42-
Code of Conduct.
43-
</p>
44-
45-
<h3 id='delete-crate'><a href='#delete-crate'>How can I delete a crate I own from the registry?</a></h3>
46-
47-
<p>
48-
You can't delete crates from the registry, but you can leave it open for
49-
transferring ownership to others.
50-
</p>
51-
52-
<p>
53-
To do this, you must publish a version with a message in the README
54-
communicating to crates.io support team that you consent to transfer the
55-
crate to the first person who asks for it:
56-
</p>
1+
<PageHeader @title='Usage Policy' />
2+
3+
<p><strong>Short version:</strong>
4+
<em>crates.io is a critical resource for the Rust ecosystem, which hosts a variety of packages from a diverse group of
5+
users. That resource is only effective when our users are able to work together as part of a community in good
6+
faith. While using crates.io, you must comply with our Acceptable Use Policies, which include some restrictions on
7+
content and conduct on crates.io related to user safety, intellectual property, privacy, authenticity, and other
8+
limitations. In short, be excellent to each other!</em></p>
9+
10+
<p>We do not allow content or activity on crates.io that:</p>
11+
12+
<ul>
13+
<li>violates the <a href='https://www.rust-lang.org/policies/code-of-conduct'>Code of Conduct</a> of the Rust project
14+
</li>
15+
<li>is unlawful or promotes unlawful activities, incurring legal liability in the countries the Rust Foundation
16+
officially operates in
17+
</li>
18+
<li>is libelous, defamatory, or fraudulent</li>
19+
<li>amounts to phishing or attempted phishing</li>
20+
<li>infringes any proprietary right of any party, including patent, trademark, trade secret, copyright, right of
21+
publicity, or other right
22+
</li>
23+
<li>unlawfully shares unauthorized product licensing keys, software for generating unauthorized product licensing
24+
keys, or software for bypassing checks for product licensing keys, including extension of a free license beyond its
25+
trial period
26+
</li>
27+
<li>contains malicious code, such as computer viruses, computer worms, rootkits, back doors, or spyware, including
28+
content submitted for research purposes (tools designed and documented explicitly to assist in security research are
29+
acceptable, but exploits and malware that use the crates.io registry as a deployment or delivery vector are not)
30+
</li>
31+
<li>uses obfuscation to hide or mask functionality</li>
32+
<li>is discriminatory toward, harasses or abuses another individual or group</li>
33+
<li>threatens or incites violence toward any individual or group, especially on the basis of who they are
34+
</li>
35+
<li>is using crates.io as a platform for propagating abuse on other platforms</li>
36+
<li>violates the privacy of any third party, such as by posting another person's personal information without
37+
consent
38+
</li>
39+
<li>gratuitously depicts or glorifies violence, including violent images</li>
40+
<li>is sexually obscene or relates to sexual exploitation or abuse, including of minors (see &quot;Sexually Obscene
41+
Content&quot; section below)
42+
</li>
43+
<li>is off-topic, or interacts with platform features in a way that significantly or repeatedly disrupts the
44+
experience of other users
45+
</li>
46+
<li>exists only to reserve a name for a prolonged period of time (often called &quot;name squatting&quot;) without
47+
having any genuine functionality, purpose, or significant development activity on the corresponding repository
48+
</li>
49+
<li>is related to buying, selling, or otherwise trading of package names or any other names on crates.io for money or
50+
other compensation
51+
</li>
52+
<li>impersonates any person or entity, including through false association with crates.io, or by fraudulently
53+
misrepresenting your identity or site's purpose
54+
</li>
55+
<li>is related to inauthentic interactions, such as fake accounts and automated inauthentic activity
56+
</li>
57+
<li>is using our servers for any form of excessive automated bulk activity, to place undue burden on our servers
58+
through automated means, or to relay any form of unsolicited advertising or solicitation through our servers, such
59+
as get-rich-quick schemes
60+
</li>
61+
<li>is using our servers for other automated excessive bulk activity or coordinated inauthentic activity, such as
62+
</li>
63+
<li>spamming</li>
64+
<li>cryptocurrency mining</li>
65+
<li>is not functionally compatible with the cargo build tool (for example, a &quot;package&quot; cannot simply be a
66+
PNG or JPEG image, a movie file, or a text document uploaded directly to the registry)
67+
</li>
68+
<li>is abusing the package index for purposes it was not intended</li>
69+
</ul>
70+
71+
<p>You are responsible for using crates.io in compliance with all applicable laws, regulations, and all of our policies.
72+
These policies may be updated from time to time. We will interpret our policies and resolve disputes in favor of
73+
protecting users as a whole. The crates.io team reserves the possibility to evaluate each instance on a case-by-case
74+
basis.</p>
75+
76+
<p>For issues such as DMCA violations, or trademark and copyright infringements, the crates.io team will respect the
77+
legal decisions of the <a href='https://rustfoundation.org/'>Rust Foundation</a> as the official legal entity
78+
providing the crates.io service.</p>
79+
80+
<h2 id='package-ownership'>Package Ownership</h2>
81+
82+
<p>crates.io has a first-come, first-serve policy on crate names. Upon publishing a package, the publisher will be made
83+
owner of the package on crates.io.</p>
84+
85+
<p>If you want to take over a package, we require you to first try and contact the current owner directly. If the
86+
current owner agrees, they can add you as an owner of the crate, and you can then remove them, if necessary. If the
87+
current owner is not reachable or has not published any contact information the crates.io team may reach out to help
88+
mediate the process of the ownership transfer.</p>
89+
90+
<p>Crate deletion by their owners is not possible to keep the registry as immutable as possible. If you want to flag
91+
your crate as open for transferring ownership to others, you can publish a new version with a message in the README or
92+
description communicating to the crates.io support team that you consent to transfer the crate to the first person who
93+
asks for it:</p>
5794

5895
<blockquote>
59-
I consent to the transfer of this crate to the first person who asks
60-
[email protected] for it.
96+
<p>I consent to the transfer of this crate to the first person who asks [email protected] for it.</p>
6197
</blockquote>
6298

63-
<h3 id='squatting'><a href='#squatting'>Squatting</a></h3>
99+
<p>The crates.io team may delete crates from the registry that do not comply with the policies on this document. In
100+
larger cases of squatting attacks this may happen without prior notification to the author, but in most cases the team
101+
will first give the author the chance to justify the purpose of the crate.</p>
64102

65-
<p>
66-
We do not have any policies to define 'squatting', and so will not hand over
67-
ownership of a package for that reason.
68-
</p>
103+
<h2 id='data-access'>Data Access</h2>
69104

70-
<h3 id='the-law'><a href='#the-law'>The Law</a></h3>
105+
<p>Details on how to access the crates.io data can be found on the dedicated <LinkTo @route="data-access">Data Access
106+
Policy</LinkTo> page.</p>
71107

72-
<p>
73-
For issues such as DMCA violations, trademark and copyright infringement,
74-
Crates.io will respect the <a href='https://foundation.rust-lang.org'>Rust Foundation</a>'s legal decisions with regards to content that
75-
is hosted.
76-
</p>
108+
<h2 id='security'>Security</h2>
77109

78-
<h3 id='code-of-conduct'><a href='#code-of-conduct'>Code of Conduct</a></h3>
110+
<p>Safety is one of the core principles of Rust, and to that end, we would like to ensure that cargo and crates.io have
111+
secure implementations. To learn more about disclosing security vulnerabilities for these tools, please reference the
112+
<a href='https://www.rust-lang.org/policies/security'>Rust Security policy</a>
113+
for more details.</p>
79114

80-
<p>
81-
The Rust project has a
82-
<a href='https://www.rust-lang.org/conduct.html'>Code of Conduct</a>
83-
which governs appropriate conduct for the Rust community. In
84-
general, any content on Crates.io that violates the Code of Conduct may be
85-
removed. Here, content can refer to but is not limited to:
86-
</p>
115+
<p>Note that this policy only applies to official Rust projects like crates.io and cargo, and not individual crates. The
116+
crates.io team and the Security Response working group are not responsible for the disclosure of vulnerabilities to
117+
specific crates, and if any issues are found, you should seek guidance from the individual crate owners and their
118+
specific policies instead.</p>
87119

88-
<ul>
89-
<li>Package Name</li>
90-
<li>Package Metadata</li>
91-
<li>Documentation</li>
92-
<li>Code</li>
93-
</ul>
120+
<p>Thank you for taking the time to responsibly disclose any issues you find.</p>
121+
122+
<h2 id='sexually-obscene-content'>Sexually Obscene Content</h2>
94123

95-
<p>
96-
There are two important, related aspects:
97-
</p>
124+
<p>We do not tolerate content associated with sexual exploitation or abuse of another individual, including where minors
125+
are concerned. We do not allow sexually themed or suggestive content that serves little or no purpose other than to
126+
solicit an erotic or shocking response, particularly where that content is amplified by its placement in profiles or
127+
other social contexts.</p>
128+
129+
<p>This includes:</p>
98130

99131
<ul>
100-
<li>
101-
We will not be pro-actively monitoring the site for these kinds of
102-
violations, but relying on the community to draw them to our attention.
132+
<li>Pornographic content</li>
133+
<li>Non-consensual intimate imagery</li>
134+
<li>Graphic depictions of sexual acts including photographs, video, animation, drawings, computer-generated images, or
135+
text-based content
103136
</li>
104137

105-
<li>
106-
“Does this violate the Code of Conduct” is a contextual question that
107-
cannot be directly answered in the hypothetical sense. All of the details
108-
must be taken into consideration in these kinds of situations.
109-
</li>
110138
</ul>
111139

112-
<h2 id='security'><a href='#security'>Security</a></h2>
113-
114-
<p>
115-
Cargo and crates.io are projects that are governed by the Rust Programming
116-
Language Team. Safety is one of the core principles of Rust, and to that end,
117-
we would like to ensure that cargo and crates.io have secure implementations.
118-
To learn more about disclosing security vulnerabilities, please reference the
119-
<a href='https://www.rust-lang.org/security.html'>Rust Security policy</a> for
120-
more details.
121-
</p>
122-
123-
<p>
124-
Thank you for taking the time to responsibly disclose any issues you find.
125-
</p>
126-
127-
<h2 id='crawlers'><a href='#crawlers'>Crawlers</a></h2>
128-
129-
<p>
130-
Before resorting to crawling crates.io, please read
131-
<LinkTo @route="data-access">Accessing the Crates.io Data</LinkTo>.
132-
</p>
133-
134-
<p>
135-
We allow our API and website to be crawled by commercial crawlers such as
136-
GoogleBot. At our discretion, we may choose to allow access to experimental
137-
crawlers, as long as they limit their request rate to 1 request per second or
138-
less.
139-
</p>
140-
141-
<p>
142-
We also require all crawlers to provide a user-agent header that allows us to
143-
uniquely identify your bot. This allows us to more accurately monitor any
144-
impact your bot may have on our service. Providing a user agent that only
145-
identifies your HTTP client library (such as "<code>request/0.9.1</code>") increases the
146-
likelihood that we will block your traffic.
147-
148-
It is recommended, but not required, to include contact information in your user
149-
agent. This allows us to contact you if we would like a change in your bot's
150-
behavior without having to block your traffic.
151-
</p>
152-
153-
<p>
154-
Bad: "<code>User-Agent: reqwest/0.9.1</code>"<br>
155-
Better: "<code>User-Agent: my_bot</code>"<br>
156-
Best: "<code>User-Agent: my_bot (my_bot.com/info)</code>" or "<code>User-Agent: my_bot (help@my_bot.com)</code>"
157-
</p>
158-
159-
<p>
160-
We reserve the right to block traffic from any bot that we determine to be in
161-
violation of this policy or causing an impact on the integrity of our service.
162-
</p>
140+
<p>We recognize that not all nudity or content related to sexuality is obscene. We may allow visual and/or textual
141+
depictions in artistic, educational, historical or journalistic contexts, or as it relates to victim advocacy. In some
142+
cases a disclaimer can help communicate the context of the project.</p>
143+
144+
<h2 id='violations-and-enforcement'>Violations and Enforcement</h2>
145+
146+
<p>crates.io retains full discretion to take action in response to a violation of these policies, including account
147+
suspension, account termination, or removal of content.</p>
148+
149+
<p>We will however not be proactively monitoring the site for these kinds of violations, but instead relying on the
150+
community to draw them to our attention.</p>
151+
152+
<p>While the majority of interactions between individuals in the Rust community falls within our policies, violations of
153+
those policies do occur at times. When they do, the crates.io team may need to take enforcement action to address the
154+
violations. In all cases, content and account deletion is permanent and there is no basis to reverse these moderation
155+
actions taken by the crates.io team. Account suspension may be lifted at the team's discretion however, for
156+
example in the case of someone's account being compromised.</p>
157+
158+
<h2 id='credits-license'>Credits &amp; License</h2>
159+
160+
<p>This policy is partially based on
161+
<a href='https://github.com/pypi/warehouse/blob/3c404ada9fed7a03bbf7c3c74e86c383f705d96a/policies/acceptable-use-policy.md'>
162+
PyPI’s Acceptable Use Policy</a> and modified from its original form.</p>
163+
164+
<p>Licensed under the
165+
<a href='https://creativecommons.org/licenses/by/4.0/'>Creative Commons Attribution 4.0 International license</a>.</p>

0 commit comments

Comments
 (0)