Let the registry publish packages, not maintainers

[nc7s]

There's long been a concern that a package on its registry and in its code repository may differ, and that may cause problems.

What if the registry takes what's in the repo and publish it? Only source code, nothing to compile. Most of the time maintainers "publish" two times anyway, once to the repository, once to the registry. If things like examples or benches are to be excluded, that could be done in Cargo.toml with something like crates-io.publish-exclude.

The publish command can be preserved, but changed to ask the registry to pull in the code and actually publish it when run.

[carols10cents]

Crates.io doesn't currently require any particular code repository/version control, or even any code published anywhere at all.

[nc7s]

Currently, no, but once published on crates.io, it's published on crates.io. And it's best practice to version control the code anyway.

[carols10cents]

Currently, no, but once published on crates.io, it's published on crates.io.

Right, which means crates.io is the source of truth for what a package contains with regards to what Cargo will pull in.

And it's best practice to version control the code anyway.

Indeed, but different people choose different version control software and code hosting services, and the amount of work it would take to support all of them isn't worth the benefit, IMO. There are higher priority issues.

What does matching up the crates.io code and the repository code get you?