Supply Chain Security Working Group
The Supply Chain Security Working Group brings together everyone running Rust in production to share how they build software securely. The group provides a place to coordinate work on mirroring crates.io, managing build tools, reviewing and applying policies to new crate releases, and responding to malicious crates and other supply-chain attacks.
Status
The working group held its kickoff meeting on September 22, 2026. Discussion is ongoing in the commercial-network channel on Zulip. We are looking for participants to help prioritize the first deliverables.
Goals
- Identify and prioritize ecosystem gaps across registry mirroring, publishing, vetting, and vulnerability response.
- Document requirements for registries and mirrors, including the web APIs and lifecycle changes that downstream tooling must observe.
- Provide feedback and case studies for work on crates.io, Cargo, dependency cooldowns, trusted publishing, and advisory monitoring.
- Coordinate upstream contributions and funding with existing maintainers and Rust Project teams.
Get Involved
Participation is open to everyone, including non-RCN members.
- Join the conversation: follow the supply chain discussion on Zulip
- Join the next meeting: see details that follow
- See what we discussed last time: check the past meeting notes
- Read the proposal: see RCN issue #168
Meetings are roughly monthly and last about an hour. Between meetings, coordination happens on Zulip.
Calendar
See the RCN meeting calendar for upcoming meetings.
Next Meeting
October 27, 2026
| Time zone | Time |
|---|---|
| Pacific (PDT) | 8:00 AM |
| Eastern (EDT) | 11:00 AM |
| UTC | 15:00 |
| Central European (CET) | 4:00 PM |
| Japan (JST) | 12:00 AM (October 28) |
| Australia Eastern (AEDT) | 2:00 AM (October 28) |
Join meeting | Agenda and notes | Zulip thread
The meeting invitation was sent to the RCN and Supply Chain mailing lists. If you did not receive it, ask in the Zulip thread to be added.