To me, the two major problems are:
- no namespaces
Someone uploads “serde2”? that’s blocked forever. Someone uploads a typo version of a popular package? Too bad for you, learn how to type.
- the github connection
If you want to contribute to crates.io you’re bound to github. No gitlab, codeberg, gitee, sourcehut, etc.
Not sure if there are any other problems, but those two seem like the biggest things and #1 is AFAIK not something they ever want to change + it would be difficult to as one would need a migration strategy.
Semver checks don’t work with straight git urls, since you can only link to an explicit branch or commit, not a version.
version can be passed with git actually. And it will need to match with the version set in Cargo.toml from the git source.
I wouldn’t call that an alternative to crate registries though (of which, crates.io is only one impl).
Also tangentially related, cargo-vendor is a thing.
Semver strings allows stuff like “version 2.5.x, but below 2.5.6”. Then cargo calculates the best solution for satisfying all dependency specifications from all packages using a single version (if possible).
Specifying a version in addition to the git branch doesn’t help there at all, because you still have to do it manually then.
