[Pkg-rust-maintainers] Bug#955208: Bug#955208: Bug#955208: Bug#955208: rustc: rustup is not available on Debian

[Ximin Luo]

Ah fair enough. Thanks for the additional detail.

Lack of signature checking is a bit annoying. It seems they have an open issue about it: https://github.com/rust-lang/rustup/issues/2028

X

Matt Corallo:
> I was just trying to ensure that the trust chain was correct here as some of the earlier comments seemed confused - unlike most other things that install software in $HOME, rustup doesn't fetch source (and optionally compile it), it just fetches binaries from the same source that provides rustup itself. Last I checked, it didn't even have signatures on them, only, as you note, checking via X509 root CAs. If people want to use that (and package it), of course.
> 
> Matt
> 
> On 3/26/21 10:19, Ximin Luo wrote:
>> Not sure what your purpose is with your comment. Nobody is asking you to package it. If somebody else wants to, this doesn't affect you, you don't have to install it.
>>
>> Packaging 3rd party software in general gives the user a trust chain from Debian trust keys to that software, rather than e.g. via HTTPS X509 root CAs.
>>
>> Lots of package managers are packaged in Debian that install other software into $HOME, such as cargo itself, opam, cabal, gem, pypi, etc etc etc.
>>
>> X
>>
>> Matt Corallo:
>>> What is the use-case for rustup being packaged? rustup is just a thin wrapper around downloading binaries from a third party, so why not just download it from the same third-party? It is geared at installing things in the local users' home directory anyway.
>>>
>>> Packaging rustup doesn't address the many limitations of rustup's rustc vs Debian's (excellently-packaged) rustc (eg cross-language LTO, LLVM plugins, etc).
>>>
>>> Matt
>>>
>>> On Sat, 4 Apr 2020 01:19:59 +0100 Ximin Luo <infinity0 at debian.org> wrote:
>>>> Hi all,
>>>>
>>>> I agree that rustup should be in Debian. Achieving this is currently blocked on either of these two issues:
>>>>
>>>> - https://github.com/rust-lang/rustup/issues/835 OR
>>>> - https://salsa.debian.org/rust-team/debcargo/-/merge_requests/22
>>>>
>>>> If you want to help, achieving either of these would help to unblock progress.
>>>>
>>>> X
>>>>
>>>> Ralph Giles:
>>>>> I would also like to start off with a Debian-packaged rustup rather
>>>>> than having to install it from upstream.
>>>>>> It's been discussed before, but I think no one was pursuaded to start
>>>>> maintaining a package. IIRC one issue was that rustup likes to update
>>>>> itself. You'd need to check how difficult it would be to have the
>>>>> system rustup always just install any updates in the user's .cargo
>>>>> subtree, without trying to write to the root filesytem. The user's
>>>>> local version would then take precedence through the normal PATH
>>>>> setting.
>>>>>> I think there was also some concern about support over the lifetime of
>>>>> a debian release, should upstream change their API sufficiently to stop
>>>>> the packaged version working.
>>>>>>    -r
>>>>>> On Sat, 2020-03-28 at 14:04 +0100, Martin Monperrus wrote:
>>>>>> Package: rustc
>>>>>> Version: 1.40.0+dfsg1-5
>>>>>> Severity: normal
>>>>>>
>>>>>> Dear Awesome Rust Debian Maintainers,
>>>>>>
>>>>>> I notice that rustup is not packaged for Debian. One option is to go
>>>>>> through
>>>>>> snap (https://snapcraft.io/install/rustup/debian) but native packages
>>>>>> are
>>>>>> preferable.
>>>>>>
>>>>>> Since rustup is used by many projects, it would be great to have it
>>>>>> natively on
>>>>>> Debian:
>>>>>>
>>>>>> apt-get install rustup
>>>>>>
>>>>>> What do you think?
>>>>>>
>>>>>> Best regards,
>>>>>>
>>>>>> --Martin
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> -- System Information:
>>>>>> Debian Release: bullseye/sid
>>>
>>> _______________________________________________
>>> Pkg-rust-maintainers mailing list
>>> Pkg-rust-maintainers at alioth-lists.debian.net
>>> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
>>
>>
> 
> _______________________________________________
> Pkg-rust-maintainers mailing list
> Pkg-rust-maintainers at alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers


-- 
GPG: ed25519/56034877E1F87C35
https://github.com/infinity0/pubkeys.git