Missing git tags (here on github) for several releases listed on crates.io

[andoks]

Is your feature request related to a problem? Please describe.
I can not find the released versions from https://crates.io/crates/webauthn-rs as tags in this repository

Describe the solution you'd like
Could you please push tags pointing to the commits in git for the releases?

Describe alternatives you've considered
Using git log and blame to manually find what commits the releases where made from as mentionend in https://users.rust-lang.org/t/psa-please-git-tag-your-crates-io-releases/22223/14

Additional context
N/A

[Firstyear]

Because we haven't tagged them in the past is why you can't find them.

@micolous Do you think we should do this in the future (and retrospectively add them?)

[micolous]

The challenge is that there are many packages in this repository, not just webauthn-rs. #456 moved most of these to use the version defined in /Cargo.toml, and v0.5.1 (released after this issue was created) has tags.

However, publishing to crates.io is still a manual process, which has some issues:

• For past releases, it would be difficult to backdate all of this, because it's just "maybe" a particular commit, but it's tedious to verify that (except maybe with Generate .cargo_vcs_info.json and include in cargo package (take 2) rust-lang/cargo#5886).

• For future releases, we'd ideally have a CI workflow which grabs everything at a particular commit and publishes it to crates.io, rather than run it on our individual workstations.

  However, those workflows generally store API keys as secrets in GitHub, which is vulnerable to a host of issues. OIDC delegation would be better, but I don't think crates.io supports this (PyPI does, though).

The other thing is because we're using workspaces, cargo publish will rewrite each package's Cargo.toml to merge the workspace Cargo.toml, so at least that definitely won't match what's in git. It also looks like cargo sneaks some metadata into these tarballs from git too: rust-lang/cargo#5886

So you may be better off bisecting the release tarballs from crates.io.

For now, I think the best we can do is to pinky-promise to add git tags going forward. Fixing it properly means getting OIDC delegation in place, and that's a Cargo/crates.io problem, not us: rust-lang/crates.io#8223 rust-lang/rfcs#3691 😄