[jasomill]

Not at all.

Most programs only use one or a few hash functions, so grouping each family into a separate crate reduces compliation time for the majority of users. Could also help when auditing the removal of vulnerable hash functions.

As for ripgrep, the organization is quite sensible:

1. one crate to define an interface for regex matchers

2. one crate to implement the native matcher

3. one crate to implement the PCRE2 matcher

4. one crate to define a safe interface to the underlying PCRE2 library

Depending on the application, any one of 1+2+3+4, 1+2, 1+3+4, or 4 alone could be useful.

[egorfine]

Yes I perfectly understand the reasoning and technically it is sound.

It becomes insane once you start thinking of real life implications, specifically supply chain attacks.

Although it's only marginally more insane than the other ecosystems.

[dralley]

The alternative is sometimes that people just copy and paste code from libraries that never gets updated.