re-maintain paste instead of a fork

[jxs]

Hi there, and first of all thanks for the interest and effort in trying to address this situation.

I found paste unmaintenance status via cargo deny as most, and when I went to the paste repository did not see any new issue trying to discuss continuity of the project despite @dtolnay no longer being able to maintain it.
I then found your post via reddit when searching for alternatives.
Was the continuity of paste under your maintenance discussed? (apologies if it was as I haven't found it there nor in the reddit post you announced pastey).

It would be ideal if ownership of the original repository could be transferred like ring did, instead of maintaining a separate fork, as that would help avoid the overhead of a full dependency switch across projects using it.

Thanks!

[AS1100K]

Thanks for your interest!

I discovered that the paste crate was unmaintained and its repository was archived a couple of months before the RustSec advisory was issued. In fact, I was the one who opened that PR in rustsec advisory database. Initially, I didn’t plan to fork it and was hoping for alternatives to emerge. However, since none did, I decided to take matters into my own hands and created pastey.

Regarding maintenance, I’m not aware of any public discussions about officially taking over paste, but recently, @decathorpe requested a transfer of the repository so they could maintain it at rustsec/advisory-db#2215 (comment)

If you’re considering a switch, you might want to hold off for a bit, as we may hear from dtolnay, and there’s a small chance that paste could be maintained again.

If dtolnay wishes, I’d also be open to maintaining or co-maintaining the paste crate myself. This would help prevent projects from either ignoring the RustSec advisory or migrating to an alternative like pastey. However, since pastey is a drop-in replacement, migration is straightforward:

[dependencies]
- paste = "1"
+ pastey = "0"

or even

[dependencies]
- paste = "1"
+ paste = { package = "pastey", version = "0" }

I have also discussed about it at https://users.rust-lang.org/t/paste-alternatives/126787/7