Published · yesterdayScience2 min read
245M is a distribution count, and nothing in the yank command subtracts from it
The figure counts copies that already left the registry. Cargo's and pip's own documentation explain why upstream cleanup does not reach them.
Written for builders.See today for builders
What happened
- The cargo yank command removes a published version from the server's index; it does not delete any data, and the crate remains available for download via the registry's download link.
- Cargo will not use a yanked version for any new project or checkout without a pre-existing lockfile, and will error if no compatible versions remain.
- If credentials have been leaked in a published crate, yanking cannot stop further spreading of them: existing lock files and direct downloads are not affected, and once a crate has been published it is impossible to determine whether the leaked credentials have been copied.
- Crates should only be yanked in exceptional circumstances; for security vulnerabilities RustSec is typically a less disruptive mechanism to inform users and encourage upgrades, and avoids significant downstream disruption irrespective of susceptibility to the vulnerability in question.
- pip provides on-by-default caching that covers HTTP responses and wheels built locally from source distributions.
Compiled by The ScientistSomething wrong?How this is made
Why it matters
The 245 million is a download count: copies of the affected crates that left the registry and landed somewhere. It is worth saying plainly that neither document supplied to this desk carries that figure, or any per-version breakdown of it [1]. What they do settle is the more useful question, which is whether a number like that can ever go down.
It cannot. Publication is one action by one party; withdrawal is one action per consumer, and the registry performs none of them. The Cargo Book takes this to its hardest case: where credentials have been leaked in a published crate, yanking cannot stop further spreading, because existing lock files and direct downloads are unaffected, and there is no way to establish whether the credentials were already copied [3].
Closer to the build, pip's cache keeps the artifact on the machine. A cached wheel matching the same package name and version is used instead of rebuilding [7], on the documented assumption that building a package from a package index is deterministic [9]. That assumption is what makes a bad build output sticky: the second install does not repeat the work, it reuses the result.
So read the figure as a lower bound on distribution, with no companion count for what is still resident in lock files and wheel caches on CI and training hosts. Rust's guidance points maintainers away from yanking for security problems and toward a RustSec advisory, which it describes as less disruptive and as avoiding downstream disruption regardless of susceptibility to the vulnerability in question [4]. An advisory is a message. Acting on it is somebody else's sprint.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The cargo yank command removes a published version from the server's index; it does not delete any data, and the crate remains available for download via the registry's download link.
- [2]
Cargo will not use a yanked version for any new project or checkout without a pre-existing lockfile, and will error if no compatible versions remain.
- [3]
If credentials have been leaked in a published crate, yanking cannot stop further spreading of them: existing lock files and direct downloads are not affected, and once a crate has been published it is impossible to determine whether the leaked credentials have been copied.
- [4]
Crates should only be yanked in exceptional circumstances; for security vulnerabilities RustSec is typically a less disruptive mechanism to inform users and encourage upgrades, and avoids significant downstream disruption irrespective of susceptibility to the vulnerability in question.
- [6]
pip provides on-by-default caching that covers HTTP responses and wheels built locally from source distributions.
- [7]
If there is a cached wheel for the same version of a specific package name, pip will use that wheel instead of rebuilding the project.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- doc.rust-lang.orgyesterdayThe Cargo Book
Cited in this coverage: The Cargo Book, doc.rust-lang.org
- pip.pypa.ioyesterdaypip documentation v24.1.dev2
Cited in this coverage: pip documentation, pip.pypa.io
