To publish a Rust crate, you still need a GitHub account
Crates.io has had only one way to log in since day one: a GitHub account. If GitHub bans you, or just goes down, you can't ship. The Rust project agrees this is bad and has agreed for a decade.
The coupling runs deep: crates.io usernames mirror GitHub usernames, the users table carries gh_login and gh_id columns, and team ownership maps onto GitHub teams. Decoupling means rebuilding auth while the registry stays live.
An RFC to unblock multi-provider login finally merged and implementation has started. But a Cargo maintainer notes the real bottleneck isn't code, it's that nobody is paid to do the boring work.
One login provider, no escape hatch
The complaint is simple and old: to publish a package to crates.io, Rust's central registry, you must "log in via a GitHub account (required for now)" — and there is no other door. The original post frames it as a supply-chain and availability problem: a single outside company can cancel a user at will, and if GitHub is down, publishing stops.
The coupling is not cosmetic. Per the tracking issue, crates.io usernames are GitHub usernames; the users table holds GitHub-specific gh_login and gh_id columns; and crate team-ownership is wired straight to GitHub teams. Undoing that means refactoring authentication on a registry the whole ecosystem pulls from every minute.
The thread already knows the fix exists
The top voice in the the thread treats it as settled risk:
"No outside single point of failure that can cancel users at will can be allowed to gatekeep open source projects." — John Nagle
Then the person doing the work showed up with the actual state of play:
"An RFC was recently merged to unblock this… The implementation on this has started." — a Cargo maintainer
The same voice supplied the reason it has taken ten years, and it is not technical: "Boring/uninteresting tasks depend on funding, a warm body to accept the funding, and a reviewer." Others reached for neighbors who solved adjacent problems. One pointed at PHP's registry:
"I have actually come to appreciate the way Packagist works… like forcing you to package from a source repository, so that you can't upload a different artifact from what you keep in source control." — a developer citing Packagist
And one zoomed out past the GitHub framing entirely:
"publishing Rust crates shouldn't depend on any single internet property, including crates.io." — a commenter raising the wider stake
That last line reframes the whole argument. Swapping GitHub for OAuth-anything fixes the cancel-at-will problem; it does nothing about the registry itself being one property everyone trusts.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Minimus makes its hardened container images free — the thread asks who pays later
A startup drops the paywall on a catalog of minimal, CVE-reduced container images, and the CTO shows up in the comments to take questions. The first question isn't about security.