Why is this such a trope in this thread? It's such a superficial strawman. Obviously cargo can copy all the dependency sources into a project's own tree if that's the right fit for a given project, and it almost definitely would be for the kernel.

There are lots of good arguments against pulling in lots of rust dependencies - it's too much code to audit, maintained by too many different upstream people and teams, lots more tooling would be needed to make sure all the dependencies are safe to use in the kernel, and on and on - but this one about an internet connection is both the most common one I've seen here and the most superficial and frankly silly.

The article itself explicitly mentioning 'cargo vendor' (which, indeed, seems like the only logical choice for the kernel, just like they already do with zstd as also mentioned in the article) leaves me extremely confused as to why people keep jumping to assuming non-vendored crate usage.

It seems like people don't know that it's possible? But obviously it's possible to pull dependency source code into the tree... The only question is whether or not there is tooling support for it. It could only possibly be a bonus to have something like cargo that can automate that workflow, rather than being forced to do it manually.

So I agree, this particular criticism is very confusing. Though as I said, that doesn't mean no criticism is warranted!

Building Rust code, and even using Cargo, doesn't require an internet connection.

ah, yes it does? 'cargo build' absolutely goes and finds dependencies, updates them, and so on.

'rustc' does not, but we are talking about cargo here.

It doesn't have to, you can "cargo vendor" all your deps (I do so for some of the things I work on, regularly building and developing without an internet connection).

OK, I have been sufficiently reminded of a mostly-offline build process and punished for my flippant remark which I can no longer edit or delete.

Thank you!

Bit of a weak argument as you require and internet conneciton to pull the source.

I can go to my nearest journal kiosk and I'm pretty confident I can find a paper Linux magazine which comes a cd with recent kernel source

> I can go to my nearest journal kiosk and I'm pretty confident I can find a paper Linux magazine which comes a cd with recent kernel source

This has to be one of the most insane threads I've read in a while.

In all likelihood, no you couldn’t. Because nobody buys those anymore.

Funny, here in Europe there are plenty of those on sale, so apparently people do still buy them.

Not in my European country at least. I haven't see a magazine with CD-ROM in years. And most people don't have a cd-dom reader anymore

Here are a couple for you,

https://www.linux-magazin.de

https://www.linuxformat.com/

The argument isn’t that they don’t exist or are not published, it’s that they are not published widely.

Given that the circulation for Linuxformat was just 19,000 in 2014, it seems that that number backs up the position that you wouldn’t find this at a street level vendor.

I would call most shopping mall surfaces and train station newstands, street level.

And what do you suppose is the ratio between train stations + shopping malls vs actual street level tobacco and magazine stands/shops is in most European countries? 1 to 700? 1 to 1000?

Any way, the whole argument is redundant. Go head to your nearest newsagent and see if they stock it. If you live on top of a train station or a supermarket then you’re due both congratulations and commiserations.

For everyone else… you can’t buy them at your nearest kiosk.

Plenty of people can buy them, even at my tiny town back home, that is a little more than "everyone else".

That wasn’t my point at all. They are specialist magazines stocked my particular places.

Because it’s not 2007, no matter how hard you wish it to be.

Street level magazine kiosks sell magazines with up to date Linux kernel CD roms? That’s a lie. I’ve literally never seen that anywhere in Europe in the last decade. You might be able to find them in specialist shops or larger supermarkets, as you can in the UK, but street level kiosks? Get real.

I'm in france, I regularly buy one of those when I take the train lol.

We have quite a bit of choice and they all have recent-ish issues: https://www.journaux.fr/linux_informatique_1_0_130.html and you can find at least a couple of them in most kiosks ; at least Linux Identity always comes with a physical disk

After using your time machine to go back to 2010.

Just went to the first one I could find and there are 4 different Linux magazines lol, here's a pic: https://ibb.co/djscJ94

If that's the case, you can do this with cargo vendor, as many other threads have mentioned

Do paper linux magazines actually exist any more?

10-15 years ago I'd agree with you, now... that would actually surprise me.

Here you go, https://www.linux-magazin.de/

you have a cd reader...?

This is not particularly relevant, as it could also be an USB stick or a SD card.

(But why wouldn't you have readers for all 3, potentially as peripherals if you don't have a desktop ?)

The last CD or DVD I had was over ten years ago. I just have no use for them.

And you don't have any friends & family that regularly come for help ?

When I built my current PC, I didn't bother with a 3.5" floppy drive, but I still had to get an USB one a couple of years ago when an acquaintance showed up needing to read some files from them...

I do but they don't use them either.

...and you don't? I can lend you mine :3

I am not sure if you are even serious

Not at all. Pulling sources, reviewing and vetting them and finally building are completely different steps.

Linux package maintainers do the vetting. Buildbots build in a clean room environment, without Internet access.

If you mix up the steps supply chain security is gone.

In certain environments i have extensively worked in, the machines on which one builds are only allowed internet access on an ip:port basis after months long process involving dozens of people in multiple teams.

Working offline is needed

And you can then stick that on a network drive or scp it on internal airgapped networks without direct internet access.

And you can do the same with the Rust dependencies (with cargo-vendor for example) Cargo has even an --offline flag.

A DVD on a Linux magazine will do.

Many people download once, use constantly and on many machines. My dev PC was never online since it was put together, all patching and updating was performed offline. All builds were bit-to-bit reproducible.

Says who? (inserts CDROM…)

It's possible to vendor all deps and have them embedded in the kernel source package.