6 ms·

OP seems to be conflating the concepts of cargo (the rust build system with dependency management functionality) and crates.io (the main and default package rep

OP seems to be conflating the concepts of cargo (the rust build system with dependency management functionality) and crates.io (the main and default package repository today). It is totally possible to use cargo without ever touching crates.io, but if you need any dependencies you'll of course have to provide them through some other means (local file system, git repositories, or a custom package repository).

mort96 4y ago
Cargo defaults to downloading stuff from crates.io. I certainly wish cargo was just a build system which doesn't care where you get your packages from, but that's not what it is.
- steveklabnik 4y ago
  Cargo does not care where you get your packages from, but it does have a default place. If you don't like it, it is easy to change.
  - mort96 4y ago
    That... is caring where I get packages from. Something like make or cmake doesn't care at all how packages end up on my drive. Almost everyone uses cargo in a way which makes cargo automatically download them from the web.
    - steveklabnik 4y ago
      If you're making that argument, you could easily turn it around: make or cmake do care where your pacakges are; they by default only build things on your local drive. The point is: all options are available for all systems, so suggesting any workflow doesn't work with any of these is just incorrect.
      - mort96 4y ago
        My point is that building code coming from my local drive is much less problematic than automatically downloading the code from some random website. And I never said any workflow doesn't work with Cargo. I said I wished it didn't download code (by default) and that it didn't care how code ended up on my drive, that it just worked like a normal build system. That you can use Cargo in that way doesn't help.
        saghm 4y ago
        > My point is that building code coming from my local drive is much less problematic than automatically downloading the code from some random website. How does the code get on your hard drive? I'd imagine from downloading it from some random website (arguably _more_ random since it's less likely to be a centralized place like crates.io). Or you could vendor the dependencies so that they're included when you get the source code for the thing you're working on, but as mentioned throughout this discussion, cargo lets you do that too.
estebank 4y ago
I could totally see the Linux Kernel setting up their own alternative Rust package mirror that cargo uses: you get the ease of use of cargo while also getting the desired level of curation. It could either be treated as owned packages, only projects written by kernel contributors, or it could be the linux distro packager model, where blessed crates at a point in time are curated, but not necessarily audited beyond some smoke tests.

mort96 4y ago

Cargo defaults to downloading stuff from crates.io. I certainly wish cargo was just a build system which doesn't care where you get your packages from, but that's not what it is.

steveklabnik 4y ago
Cargo does not care where you get your packages from, but it does have a default place. If you don't like it, it is easy to change.
- mort96 4y ago
  That... is caring where I get packages from. Something like make or cmake doesn't care at all how packages end up on my drive. Almost everyone uses cargo in a way which makes cargo automatically download them from the web.
  - steveklabnik 4y ago
    If you're making that argument, you could easily turn it around: make or cmake do care where your pacakges are; they by default only build things on your local drive. The point is: all options are available for all systems, so suggesting any workflow doesn't work with any of these is just incorrect.
    - mort96 4y ago
      My point is that building code coming from my local drive is much less problematic than automatically downloading the code from some random website. And I never said any workflow doesn't work with Cargo. I said I wished it didn't download code (by default) and that it didn't care how code ended up on my drive, that it just worked like a normal build system. That you can use Cargo in that way doesn't help.
      - saghm 4y ago
        > My point is that building code coming from my local drive is much less problematic than automatically downloading the code from some random website. How does the code get on your hard drive? I'd imagine from downloading it from some random website (arguably _more_ random since it's less likely to be a centralized place like crates.io). Or you could vendor the dependencies so that they're included when you get the source code for the thing you're working on, but as mentioned throughout this discussion, cargo lets you do that too.

estebank 4y ago

I could totally see the Linux Kernel setting up their own alternative Rust package mirror that cargo uses: you get the ease of use of cargo while also getting the desired level of curation. It could either be treated as owned packages, only projects written by kernel contributors, or it could be the linux distro packager model, where blessed crates at a point in time are curated, but not necessarily audited beyond some smoke tests.