On 13/01/2025 14.36, Michał Górny wrote:
On Mon, 2025-01-13 at 10:40 +0100, Florian Schmaus wrote:
First, switching from individual crates to a single crate tarball
disallows inter-package crate archive reuse. Often, users will already
have the required crates downloaded because another installed package
used them. With an artificial create count limit, users must download
rather large crate tarballs, causing unnecessary traffic and increasing
the disk space on Gentoo's mirrors and end-user systems. The crate
tarballs quickly eat away the saved disk space in the ebuild repository.
I'm sure you've also done a thorough analysis on how much crate reuse
actually happens, as well as of the impact of adding thousands of tiny
files to Gentoo mirrors, the inefficiency of fetching them one by one,
and especially how badly crates.io actually handles that.
I'm also sure you've done a thorough analysis of actual disk space use,
that also takes into consideration the space wasted by thousands of
tiny, inefficiently compressed files, compared to crate tarballs that
benefit both from much stronger compression algorithm, as well
as the opportunity to process much larger data blocks.
If you have numbers backing up the claimed adverse effects, please share
them. I have demonstrated my calculations regarding ::gentoo size growth
and its negligible effect.
I think I should *not* be the one to prove that your change is required.
It is the responsibility of the person suggesting the change.
Even worse, crate tarballs negatively impact the security of Gentoo
users as they make it harder to audit ebuilds, and third-party crate
tarballs add a further distinct party that can inject malicious code.
Considering the recent supply chain attacks, this alone is a show-stopper.
`cargo audit` does not care about how crates are delivered to Gentoo
systems.
I was referring to "detecting malicious modifications" as auditing. What
'cargo audit' does is unrelated to this.
Why is this warning suddenly necessary? Did a user run into an issue
caused by more than 300 entries?
It is not "sudden". It is an ongoing effort.
It certainly feels like all of a sudden to me. At least, as far as I
understand, there is no trigger event or similar. I am sorry, but
instead, it appears that you have decided that today is the day when we
need this.
- Flow
OpenPGP_0x8CAC2A9678548E35.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
