[eimrine]

I mean the approval process for packages in Cargo is controlled by vendor.

[zamadatix]

Do you mean the default crates.io registry Cargo uses? Cargo is the package manager, it supports alternative registry definitions and local packages all set in the dependency file. You can run your own private or public registry, or use someone else's, and publish anything you want.

[margorczynski]

By that reasoning almost every Linux distro is also non-free as it uses a default repository for packages.

[M2Ys4U]

One can use cargo without using crates.io, though due to network effects it'd be a pain to do