4 ms·
>I've found it a really useful tool for installing things like Rust or Deno. For Rust you can ignore sh.rustup.rs and just download and set up rustup manually.
by Arnavion 4y ago
>I've found it a really useful tool for installing things like Rust or Deno.
For Rust you can ignore sh.rustup.rs and just download and set up rustup manually.
CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}"
mkdir -p "$CARGO_HOME/bin"
curl -Lo "$CARGO_HOME/bin/rustup" 'https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init'
chmod +x "$CARGO_HOME/bin/rustup"
hash -r
rustup set auto-self-update disable
rustup set profile minimal
rustup default stable
rustup update --force
rustup self update # Create hardlinks under $CARGO_HOME/bin/
- IshKebab 4y agoAwesome, that avoids downloading and running executable code from the Rust project!
- steveklabnik 4y agorustup is still executable code you are downloading from the Rust Project. It then downloads Cargo and rustc, which are both executable code, downloaded via the Rust project. The only difference here is that you’re running a few commands by hand instead of running them in a single invocation of a shell script.
- Arnavion 4y agoYeah, the only thing this achieves is not having to worry about the `curl | sh` step. The rest of the threat model is exactly the same.
- IshKebab 4y agoOf course; I was being sarcastic.
- steveklabnik 4y agoPoe’s law strikes again, my bad!