# cargo-crev を Homebrew, apk, Nix, pacman でインストール cargo-crev のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:cargo-crev ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install cargo-crev ``` 証拠: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add cargo-crev ``` 証拠: Alpine Linux edge package indexes: cargo-crev from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz - Nix (92%): ```sh nix profile install nixpkgs#cargo-crev ``` 証拠: nixpkgs package indexes: pkgs/by-name/ca/cargo-crev/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S cargo-crev ``` 証拠: Arch Linux sync databases: cargo-crev from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## パッケージ情報 - **パッケージキー:** brew:cargo-crev - **パッケージマネージャ:** Homebrew - **バージョン:** 0.27.1 - **ソース概要:** Code review system for the cargo package manager - **ホームページ:** - **リポジトリ:** - **最終更新:** 2026-06-22T14:02:57-07:00 - **生成日時:** 2026-08-03T19:37:03+00:00 ## 実行可能ファイル - cargo-crev (エイリアス) ## インストール挙動 - Bottle: 利用不可 ## バージョンと鮮度 - ページ生成日: 2026-08-03 - マネージャ版: 0.27.1 ## プロジェクトの歴史と使われ方 cargo-crev is a cryptographically verifiable code-review and trust tool for Cargo dependencies. It implements the broader Crev idea for Rust by letting users publish package reviews, consume reviews from others, and build a web of trust around crates. ### プロジェクトの歴史 The repository was created in 2018 and the README describes Crev as a language- and ecosystem-agnostic distributed code-review system. cargo-crev is the Cargo-integrated command-line implementation for Rust users. Early project history is tied to the dpc/crev lineage; later changelog entries and repository organization show the project under crev-dev/cargo-crev, with continued releases and documentation for trust, package review, verification, and proof repositories. ### 採用の歴史 cargo-crev emerged during growing Rust concern over transitive dependency trust and supply-chain review. Its adoption is more cultural than universal: the README asks supportive projects to recommend it, while package-manager availability in apk, Homebrew, Nix, and pacman makes it accessible to security-minded developers. The tool has remained active through 2026. The changelog records later features such as exporting toward cargo-vet workflows and AI-assisted review-loop commands, showing that it continues to adapt to Rust supply-chain review practice. ### 使われ方 Users initialize an identity and proof repository, review crates, publish signed proofs, fetch other users' proofs, and run verification commands against project dependencies. The tool can warn about untrustworthy crates, report dependency metrics, and help identify dependency bloat. Unlike scanners that only consume centralized advisories, cargo-crev is built around human review statements and trust delegation. That makes it useful when a team wants auditable social trust, not only vulnerability matching. ### パッケージ好きにとっての重要性 cargo-crev is one of the Rust ecosystem's most explicit attempts to make package trust a first-class artifact. It treats reviews as distributed, cryptographically verifiable package metadata rather than comments trapped in a website or issue tracker. For package-history work, it is important because it documents an alternative path for supply-chain security: reviewer reputation, signed proofs, and webs of trust alongside registries and vulnerability databases. ### タイムライン - 2018: GitHub repository created. - 2018: crates.io records the first cargo-crev publication. - 2022: Changelog records proof storage moving toward data directories and new web-of-trust diagnostics. - 2025: Changelog records crevette export support toward cargo-vet. - 2026: Changelog records 0.27.x releases adding AI review-loop commands and Rust 2024 edition work. ### Related projects - Crev is the ecosystem-agnostic distributed code-review system that cargo-crev implements for Cargo. - cargo-vet is a related Rust supply-chain review tool, and the cargo-crev changelog mentions crevette export support toward cargo-vet. - RustSec-style advisory databases address vulnerability matching, while cargo-crev focuses on signed human trust and review proofs. ### ソース - - - - ## セキュリティノート infrastructure mutation or orchestration signal. - **Geiger リスク:** orange / 中 - infrastructure mutation or orchestration signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.config/crev/proofs/ ## 他のパッケージマネージャ記録 - Nix - cargo-crev: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cargo-crev/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - cargo-crev - 0.26.3-r0: normalized package name match | Alpine Linux edge package indexes: cargo-crev from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Cryptographically verifiable code review system for cargo | https://github.com/crev-dev/cargo-crev - pacman - cargo-crev - 0.27.1-2: normalized package name match | Arch Linux sync databases: cargo-crev from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Scalable, social, Code REView and recommendation system that we desperately need | https://github.com/crev-dev/cargo-crev ## Combined YAML source View the package source record on GitHub. [combined/cargo-crev.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cargo-crev.yml) ## ソース - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph