RFE: Support Crate Ownership
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- python
- Domain
- api, authorization, backend, database
Research direction
Start with the proposed CrateOwnership model and CargoPublishApiView.put(), then review the three Cargo owner endpoints and the yank authorization path. Done means ownership is scoped per distribution, first publishers are assigned automatically, owners can manage owners, and publish/yank permissions follow the stated rules while unauthenticated ownership mode remains supported.
Written by the indexing model from the issue text.
Description
Consider supporting Crate ownership like crates.io -- users would be able to publish or modify only crates which they have maintainership over.
This is more of a long-term plan and should probably be optional. The "if you can auth, you can push" mode ought to continue being supported.
Crate Ownership
Goal: Track who owns which crate names, and only allow owners to publish new versions or yank. Deferred — any authenticated user with distribution-level permission can publish any crate name for now.
a. CrateOwnership model
class CrateOwnership(BaseModel):
distribution = models.ForeignKey(RustDistribution, on_delete=models.CASCADE)
crate_name = models.CharField(max_length=255)
user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
class Meta:
unique_together = ("distribution", "crate_name", "user")
- Scoped per-distribution (different registries can have different owners for the same crate name)
- First publisher of a crate name automatically becomes owner
- Owners can add/remove other owners
b. Ownership endpoints
Implement the Cargo owner API:
GET /api/v1/crates/{name}/owners— list ownersPUT /api/v1/crates/{name}/owners— add owner (body:{"users": ["username"]})DELETE /api/v1/crates/{name}/owners— remove owner
c. Publish authorization check
In CargoPublishApiView.put():
- If the crate name has no owners yet → allow (auto-assign publisher as owner)
- If the crate name has owners → only allow if
request.useris an owner
d. Yank authorization check
Only crate owners (or distribution admins) can yank/unyank.
- Dominant language
- Python
- Stars
- 1
- Forks
- 5
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 5
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pulp/pulp_rust
-
RFE: Support Token ScopingPossibly taken @aKlimau claimed this 16 days ago. OpenFeature Triage-Needed
-
Feature Triage-Needed
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Feature Triage-Needed
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
Similar issues
-
comp/tools duplicate P2 sweeper:risk-compatibility tool/mcp type/bug
Difficulty 1/5 Under an hour Newbie friendliness 88/100
NousResearch/hermes-agent#132042 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
deepset-ai/haystack#13092 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
EverMind-AI/Raven#845 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AstrBotDevs/AstrBot#10340 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
BasedHardware/omi#20401 · 1 comment ·
Maintainers usually reply within 1 day