I was just trying to ensure that the trust chain was correct here as some of the earlier comments seemed confused -
unlike most other things that install software in $HOME, rustup doesn't fetch source (and optionally compile it), it
just fetches binaries from the same source that provides rustup itself. Last I checked, it didn't even have signatures
on them, only, as you note, checking via X509 root CAs. If people want to use that (and package it), of course.
Matt
On 3/26/21 10:19, Ximin Luo wrote:
Not sure what your purpose is with your comment. Nobody is asking you to
package it. If somebody else wants to, this doesn't affect you, you don't have
to install it.
Packaging 3rd party software in general gives the user a trust chain from
Debian trust keys to that software, rather than e.g. via HTTPS X509 root CAs.
Lots of package managers are packaged in Debian that install other software
into $HOME, such as cargo itself, opam, cabal, gem, pypi, etc etc etc.
X
Matt Corallo:
What is the use-case for rustup being packaged? rustup is just a thin wrapper
around downloading binaries from a third party, so why not just download it
from the same third-party? It is geared at installing things in the local
users' home directory anyway.
Packaging rustup doesn't address the many limitations of rustup's rustc vs
Debian's (excellently-packaged) rustc (eg cross-language LTO, LLVM plugins,
etc).
Matt
On Sat, 4 Apr 2020 01:19:59 +0100 Ximin Luo <infini...@debian.org> wrote:
Hi all,
I agree that rustup should be in Debian. Achieving this is currently blocked on
either of these two issues:
- https://github.com/rust-lang/rustup/issues/835 OR
- https://salsa.debian.org/rust-team/debcargo/-/merge_requests/22
If you want to help, achieving either of these would help to unblock progress.
X
Ralph Giles:
I would also like to start off with a Debian-packaged rustup rather
than having to install it from upstream.
It's been discussed before, but I think no one was pursuaded to start
maintaining a package. IIRC one issue was that rustup likes to update
itself. You'd need to check how difficult it would be to have the
system rustup always just install any updates in the user's .cargo
subtree, without trying to write to the root filesytem. The user's
local version would then take precedence through the normal PATH
setting.
I think there was also some concern about support over the lifetime of
a debian release, should upstream change their API sufficiently to stop
the packaged version working.
-r
On Sat, 2020-03-28 at 14:04 +0100, Martin Monperrus wrote:
Package: rustc
Version: 1.40.0+dfsg1-5
Severity: normal
Dear Awesome Rust Debian Maintainers,
I notice that rustup is not packaged for Debian. One option is to go
through
snap (https://snapcraft.io/install/rustup/debian) but native packages
are
preferable.
Since rustup is used by many projects, it would be great to have it
natively on
Debian:
apt-get install rustup
What do you think?
Best regards,
--Martin
-- System Information:
Debian Release: bullseye/sid
_______________________________________________
Pkg-rust-maintainers mailing list
pkg-rust-maintain...@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
