Tracking Issue for "Crate Deletions"

[Turbo87]

This is a tracking issue for the RFC "crates.io: Crate Deletions" (rust-lang/rfcs#3660).

About tracking issues

Tracking issues are used to record the overall progress of implementation.
They are also used as hubs connecting to other relevant issues, e.g., bugs or open design questions.
A tracking issue is however not meant for large scale discussion, questions, or bug reports about a feature.
Instead, open a dedicated issue for the specific matter and add the relevant feature gate label.
Discussion comments will get marked as off-topic or deleted.
Repeated discussions on the tracking issue may lead to the tracking issue getting locked.

Steps

• Implement crate deletion API endpoint (Implement DELETE /api/v1/crates/:crate_id endpoint #9904)
• Implement crate deletion user interface (UI: Implement /crates/:name/delete route #10177)
• Implement version deletion API endpoint
• Implement version deletion user interface
• Update https://crates.io/policies to no longer mention that "Crate deletion by their owners is not possible"

Unresolved Questions

• Should names of deleted crates be blocked so that they can't be re-used?
• Should deleted versions be blocked from being re-uploaded?
• Should we keep and mark deleted versions in the index?

[carols10cents]

Two pieces of feedback now that I've tested the /delete route in staging:

1. The page that shows up on /delete says:

Requirements:

A crate can only be deleted if:

1. the crate has been published for less than 72 hours, or
2. the crate only has a single owner, and
   the crate has been downloaded less than 100 times for each month it has been published, and
   the crate is not depended upon by any other crate on crates.io.

I forgot what the RFC actually decided on, and I missed that little "or" at the end of the first requirement. It would be nice if that was a bit more obvious, either put a big "OR" between 1 and 2 along the left, or maybe change "A crate can only be deleted if" to something like "A crate can only be deleted if one of the two following applies".

2. I published a new crate to test this out and I got an email when I published the crate, but I did not get an email when I deleted the crate. I think deleting should send an email too as it could be a sign of account compromise if it wasn't the owner who did it.

[Turbo87]

thanks for the feedback!

I had that thought about the email as well, but somehow forgot about it again... 😅

[Turbo87]

feedback from a support request:

Thank you for letting me know about the crate deletion feature. I've tried using it, but unfortunately I'm unable to delete my crates as they have over 100 downloads.

this was from a couple of crates that were created 2 months ago, had a couple of versions and about 1000 downloads