Packaging Rust for Fedora

Posted Oct 30, 2022 15:25 UTC (Sun) by gilnaa (guest, #161422)
In reply to: Packaging Rust for Fedora by ssokolow
Parent article: Packaging Rust for Fedora

You can achieve this by hosting your own registry, which is basically just another http server.

Packaging Rust for Fedora

Posted Oct 30, 2022 16:16 UTC (Sun) by mathstuf (subscriber, #69389) [Link]

Note that my idea (that I've posted about before) is that installing a Rust package puts its crate into a machine-local registry. This would allow for automatic resolution to distro-provided versions based on `BuildRequires:` and the like.

Note that just rehosting `crates.io` might not be preferrable since they can be post-codegen steps (of various kinds) and instead `cargo publish` into this registry that is then pulled out during some `rpm-cargo-*` macro magic would probably be a better mechanism.

Packaging Rust for Fedora

Posted Oct 30, 2022 16:18 UTC (Sun) by ssokolow (guest, #94568) [Link] (2 responses)

How does that solve the "unified" requirement? A flatpak manifest puts all the hashes and URLs in the same JSON or YAML file, regardless of what language each dependency is written in.

Packaging Rust for Fedora

Posted Oct 30, 2022 16:43 UTC (Sun) by mathstuf (subscriber, #69389) [Link] (1 responses)

Just because you have the hash doesn't mean you have the source available when you need/want it. If some registry goes down due to a DNS renewal failure, "hostile" acquisition, or other fun things, that hash list is quite useless.

Packaging Rust for Fedora

Posted Oct 30, 2022 17:16 UTC (Sun) by ssokolow (guest, #94568) [Link]

Of course. I'm saying that, just because you have a local Cargo registry, and a Conan registry, and a pip registry, and so on doesn't mean you have a clean, unified, easy-to-use way to check your bill of materials.

Conversely, if you have something like a flatpak manifest, you can use flatpak-builder arguments like --download-only, --disable-download, and --bundle-sources to easily cache and manage access to dependency sources.