> There's a ton of things I like about Rust but the points he outlined above are things that I've seen very much impede the adoption of Rust into some environments that have similar restrictions(no download on build, build from source without binaries) for security and reproducibility reasons.
They're all on the roadmap for the very near future, because Servo (and Rust-in-Gecko) needs them. There's nothing in the design of Cargo that prevents these from being solved.
Personally, I love Cargo. Autoconf is miserable and I would hate to go back to it.
Re:Two Weeks of Rust
by steveklabnik on Tuesday January 12, 2016 @12:37PM
(#10888859)
As I said to the parent, if offline builds do not work, please file bugs. Integrating Rust code into Firefox requires the same restrictions that you're talking about, and is a use case we explicitly want to support, and already do, to a certain extent.
Reproducibility is the thing that bothers me most about auto-downloading build systems. On the other hand, Cargo (IIRC) doesn't do what Maven does: if you say you want version X, you get version X or anything newer (unless you jump through hoops that I've never seen anyone jump through).
[Security just scares the piss out of me in general; downloading binaries is probably the smallest problem.]
Re:Two Weeks of Rust
by burntsushi on Tuesday January 12, 2016 @01:38PM
(#10889342)
Cargo follows semver by default. Specifying version "1" means "1.x.x, <2".
Pinning versions is simple. e.g., "=1.2.3".
You can read more about it here: http://doc.crates.io/crates-io.html
Re:Two Weeks of Rust
by steveklabnik on Tuesday January 12, 2016 @01:54PM
(#10889491)
And even when you have a range, Cargo.lock means that you get reproducable (in this sense) automatically.
There's a ton of things I like about Rust but the points he outlined above are things that I've seen very much impede the adoption of Rust into some environments that have similar restrictions(no download on build, build from source without binaries) for security and reproducibility reasons.