4 ms·

Going to have to agree with dozzie here, he's right on almost all accounts. There's a ton of things I like about Rust but the points he outlined above are thin

Going to have to agree with dozzie here, he's right on almost all accounts. There's a ton of things I like about Rust but the points he outlined above are things that I've seen very much impede the adoption of Rust into some environments that have similar restrictions(no download on build, build from source without binaries) for security and reproducibility reasons.

steveklabnik 11y ago
As I said to the parent, if offline builds do not work, please file bugs. Integrating Rust code into Firefox requires the same restrictions that you're talking about, and is a use case we explicitly want to support, and already do, to a certain extent.
pcwalton 11y ago
> There's a ton of things I like about Rust but the points he outlined above are things that I've seen very much impede the adoption of Rust into some environments that have similar restrictions(no download on build, build from source without binaries) for security and reproducibility reasons. They're all on the roadmap for the very near future, because Servo (and Rust-in-Gecko) needs them. There's nothing in the design of Cargo that prevents these from being solved. Personally, I love Cargo. Autoconf is miserable and I would hate to go back to it.
mcguire 11y ago
Reproducibility is the thing that bothers me most about auto-downloading build systems. On the other hand, Cargo (IIRC) doesn't do what Maven does: if you say you want version X, you get version X or anything newer (unless you jump through hoops that I've never seen anyone jump through). [Security just scares the piss out of me in general; downloading binaries is probably the smallest problem.]
- burntsushi 11y ago
  Cargo follows semver by default. Specifying version "1" means "1.x.x, <2". Pinning versions is simple. e.g., "=1.2.3". You can read more about it here: http://doc.crates.io/crates-io.html http://doc.crates.io/crates-io.html
  - steveklabnik 11y ago
    And even when you have a range, Cargo.lock means that you get reproducable (in this sense) automatically.

steveklabnik 11y ago

As I said to the parent, if offline builds do not work, please file bugs. Integrating Rust code into Firefox requires the same restrictions that you're talking about, and is a use case we explicitly want to support, and already do, to a certain extent.

pcwalton 11y ago

> There's a ton of things I like about Rust but the points he outlined above are things that I've seen very much impede the adoption of Rust into some environments that have similar restrictions(no download on build, build from source without binaries) for security and reproducibility reasons. They're all on the roadmap for the very near future, because Servo (and Rust-in-Gecko) needs them. There's nothing in the design of Cargo that prevents these from being solved. Personally, I love Cargo. Autoconf is miserable and I would hate to go back to it.

mcguire 11y ago

Reproducibility is the thing that bothers me most about auto-downloading build systems. On the other hand, Cargo (IIRC) doesn't do what Maven does: if you say you want version X, you get version X or anything newer (unless you jump through hoops that I've never seen anyone jump through). [Security just scares the piss out of me in general; downloading binaries is probably the smallest problem.]

burntsushi 11y ago
Cargo follows semver by default. Specifying version "1" means "1.x.x, <2". Pinning versions is simple. e.g., "=1.2.3". You can read more about it here: http://doc.crates.io/crates-io.html http://doc.crates.io/crates-io.html
- steveklabnik 11y ago
  And even when you have a range, Cargo.lock means that you get reproducable (in this sense) automatically.