RFC should/when could skrub be added as trusted source by skops?

[MarieSacksick]

As of today, skops do no consider skrub as a trusted source.

# %%
from sklearn.datasets import load_iris
from sklearn.model_selection import train_test_split
from skrub import tabular_learner

X, y = load_iris(return_X_y=True, as_frame=True)
X_train, X_test, y_train, y_test = train_test_split(X, y, random_state=42)

model = tabular_learner("classifier")
model.fit(X_train, y_train)

# %%
from skops import io as sio

sio.dump(model, "skrub_model.skops")

# %%
model_loaded = sio.load("skrub_model.skops")

Renders the UntrustedTypesFoundException.

In the context of presenting skops, skrub & skore as in the same world, it would make it more consistant.
I'm leaving skore out of scope for now because it's more moving today.

[adrinjalali]

Generally speaking, we don't want to trust a whole package anyway. We don't even trust everything from numpy or sklearn.

As for tabular learner and similar objects, one needs to check their code and validate nothing shady can happen by the user. Those objects can be pretty powerful, which means they might be giving users a lot of freedom. I haven't checked them, so I can't give an assessment now. But I'm open to the idea of them being checked and potentially trusted by default.

However, if this is something which comes up in https://github.com/probabl-ai/skore/ , then it can also be handled there by adding more trusted types there by default if required.