4 ms·

But this was only necessary because the binary packages for py310-cryptography did not exist on MacPorts for your platform at the time you did the upgrade. MacP

But this was only necessary because the binary packages for py310-cryptography did not exist on MacPorts for your platform at the time you did the upgrade. MacPorts therefore had to build from source, and that necessitates installing the compiler. Nowadays, with the appropriate binary package on macports.org, installing the Rust compiler should no longer be necessary. For example, I have successfully installed the py310-cryptography module just now off of MacPorts without rust being installed. Rust binary packages intentionally do not rely on a language runtime (only libc), whereas Rust source packages will naturally need to rely on the Rust compiler. Building from source is always going to be more painful than installing a binary package; I have packages in MacPorts that can take hours to build from source (binaries not available, usually due to using an uncommon mix of feature flags). It's misleading to suggest, however, that the little package you installed carries 393 dependencies, when those are the dependencies of the compiler rather than the package itself.

Bogdanp 3y ago
I think we agree that MacPorts is doing the best it can here. In my view[1], the issue is a package in one language introducing a dependency on an entirely different, uncommon, language runtime and toolchain. Until relatively recently (at least with respect to the post), the cryptography package did not require Rust at all. A secondary issue is the amount of dependencies actually involved in building a cryptography package. How many of those dependencies are compiler dependencies or not is not relevant to my mind; the cryptography package still transitively depends on them by way of the compiler (and by way of the package manager) and any one of those dependencies could probably read my SSH keys or do $deity knows what else to my computer. [1]: I agree this isn't particularly well expressed by the post, nor perhaps by these comments here, but now I have to run get a haircut!

Bogdanp 3y ago

I think we agree that MacPorts is doing the best it can here. In my view[1], the issue is a package in one language introducing a dependency on an entirely different, uncommon, language runtime and toolchain. Until relatively recently (at least with respect to the post), the cryptography package did not require Rust at all. A secondary issue is the amount of dependencies actually involved in building a cryptography package. How many of those dependencies are compiler dependencies or not is not relevant to my mind; the cryptography package still transitively depends on them by way of the compiler (and by way of the package manager) and any one of those dependencies could probably read my SSH keys or do $deity knows what else to my computer. [1]: I agree this isn't particularly well expressed by the post, nor perhaps by these comments here, but now I have to run get a haircut!