Rusk
What it is
Rusk is a free package manager for JavaScript and Python projects on Linux, macOS, and Windows. It verifies package artifacts before installation, checking SHA-256 digests during downloads and validating its content-addressed cache. Rusk detects rusk.toml, package.json, pyproject.toml, and requirements.txt, so existing projects need no configuration file. Its lockfile pins transitive dependencies with exact digests and can migrate from npm, Yarn, and pnpm lockfiles. Rusk verifies npm ECDSA signatures and PyPI PEP 740 attestations, while detecting provenance changes during updates. Users can set signature and provenance requirements, run audits, and inspect why packages were allowed or blocked. Build isolation includes environment scrubbing with process or container backends. Commands provide JSON output and structured CI exit codes. Anomaly reports can be sent to Slack, PagerDuty, Datadog, or any JSON endpoint without blocking installs. Rusk supports npm, PyPI, custom indexes, Git dependencies, offline caching, and package publishing. Installation options include release binaries, Cargo, or source builds requiring Rust 1.75 or later.
For and against
For
- Free plan for JavaScript and Python projects
- Detects common manifests without configuration
- Pins exact dependency digests in lockfiles
- Verifies signatures, attestations, and provenance
- Provides JSON output and CI exit codes
Against
- Source builds require Rust 1.75 or later
- Anomaly reports do not block installs
- Release binaries vary by listed architecture and release
The verdict
Rusk combines package management with digest, signature, provenance, and build checks. Its manifest detection, lockfile migration, and CI reporting make it suited to projects that want configurable installation trust controls.
Who it suits
Rusk suits JavaScript and Python developers, mixed-language monorepos, and CI pipelines that need package verification and policy controls. It supports Linux, macOS, and Windows users.
On the record
- Audience
- The README describes Rusk as usable for JavaScript and Python projects, including mixed-language monorepos and CI pipelines.github.com · read 5 Oct 2026
- Build isolation
- Rusk includes a build sandbox with process and container backends and environment scrubbing.github.com · read 5 Oct 2026
- CI and alerts
- Rusk supports structured exit codes, JSON output, and anomaly reports sent to Slack, PagerDuty, Datadog, or any endpoint accepting JSON.github.com · read 4 Oct 2026
- CI output
- All commands support JSON output, and Rusk provides structured CI exit codes.github.com · read 5 Oct 2026
- Distribution
- The README gives GitHub release binaries, Cargo installation, and source build as installation options; building from source requires Rust 1.75 or later.github.com · read 5 Oct 2026
- Download platforms
- The README says release binaries are available for Linux, macOS, and Windows on x86_64 and aarch64; the releases page lists a Windows x64 binary for v0.1.1.github.com · read 4 Oct 2026
- Existing projects
- It auto-detects package.json, requirements.txt, and pyproject.toml, and the README says no configuration file is needed for existing projects.github.com · read 5 Oct 2026
- Installation
- The README gives installation options through release binaries, cargo install, or building from source with Rust 1.75 or later.github.com · read 4 Oct 2026
- Install integrity
- Rusk checks package SHA-256 digests during downloads and pins package digests in its lockfile.github.com · read 5 Oct 2026
- Integrity checks
- It verifies package SHA-256 digests and checks content-addressed cache integrity.github.com · read 4 Oct 2026
- License
- The project is licensed under Apache-2.0.github.com · read 4 Oct 2026
- Lockfiles
- Its lockfile pins transitive dependencies with exact digests and supports migration from npm, Yarn, and pnpm lockfiles.github.com · read 4 Oct 2026
- Manifest support
- Rusk auto-detects rusk.toml, package.json, pyproject.toml, and requirements.txt.github.com · read 4 Oct 2026
- Migration and compatibility
- The README says Rusk can migrate lockfiles from npm, Yarn, and pnpm and supports .npmrc authentication tokens with environment variable expansion.github.com · read 5 Oct 2026
- Other package sources
- The feature list includes custom index URLs, Git dependencies, and .npmrc authentication token support.github.com · read 4 Oct 2026
- Package sources
- Rusk supports npm and PyPI registries, custom index URLs, and Git dependencies.github.com · read 5 Oct 2026
- Policy controls
- Users can configure signature and provenance requirements and use audit, verify, and explain commands to inspect package trust.github.com · read 5 Oct 2026
- Product
- Rusk is a package manager for JavaScript and Python that verifies artifacts before installation.github.com · read 4 Oct 2026
