A multi-ecosystem distributed package review system.
Software packages are usually used without review. Who's checked the code? Typically, no one but the author. Vouch is a review system designed to solve this problem.
Vouch evaluates software dependencies using user generated micro-reviews. Even single line reviews become powerful when aggregated!
First, lets setup Vouch. During setup we can optionally specify a git repository URL for publishing reviews.
vouch setup https://github.com/<username>/reviews
(Note: Vouch currently requires VSCode to create reviews.)
vouch review d3 4.10.0
Subscribe to reviews created by other users using the command:
vouch peer add https://github.com/vouch-dev/example-reviews
The sync command pulls new reviews from peers and publishes user generated reviews:
Reviews created using Vouch can be used to evaluate software project dependencies. Vouch extensions can discover ecosystem specific dependency definition files. For example, the Python extension parses
check command generates an evaluation report of local project dependencies based on available reviews: