Identifying dependency passlist candidates

[workingjubilee]

We can imagine a list of requirements for "is this crate safe to build as a dependency?" in a very low-trust user environment. Throwing some darts at the wall, meeting the following requirements would make it easy to justify building a given crate as a dependency for a PL/Rust function:

• Does not have a build.rs
• Is not a proc macro
• Compiles while forbidding unsafe code
• Is not in the RustSec Advisory Database
• Meets certain licensing requirements?
• Some other requirements I am not thinking of currently
• ...for all transitive dependencies

We may want to also figure out how to more finely grade crates than "yes or no" and generate, essentially, a "safety recommendation" for a given crate as to whether it should be added to the passlist. In a higher-trust environment, as determined by the installing superuser DBA (who, remember, is the ultimate human source of trust for both PL/Rust and credentials to the database thus what they say is trustworthy is), the DBA may want to dial a threshold for automatic acceptance.