cargo

Same thing in Cargo: http://sasheldon.com/blog/2017/05/07/how-i-broke-cargo-for-w... https://github.com/rust-lang/cargo/issues/3982

the second 'precaution' fix looks actually important because it stops an archive from a following a symlink it creates that would allow it to write outside of the package directory. my thoughts are: before the precaution fix this was a legal archive: $crate_name-$crate_version/outside -> ../ $crate_name-$crate_version/outside/$other_crate-$other-version/blah/blah then you have this code: https://github.com/rust-lang/cargo/pull/4493/files#diff-ce3a... tar.unpack(dst.parent().unwrap())?; so while Archive#unpack protects you against following symlinks outside of `dst` (which is a really good default!) it doesn't protect you from following symlinks inside of `dst` so presumably you can use the symlink trick to overwrite other packages. i haven't tested this so this could be wrong :/ like maybe archive by default doesn't create sym

I remember my first experience with That's flaky tests! (or more accurately, Cargo's: https://github.com/rust-lang/cargo/pull/3715

Cargo now runs on an Android host. I'm not an Android dev so I don't know what that means regarding the NDK. https://github.com/rust-lang/cargo/pull/3885/files#diff-27a1... would imply to me that oyu still need an NDK.

Yeah, I agree with this. This confused me when I first started using the language. I do think there could be some better options for caching or downloading precompiled packages, but I also think this has partly helped with the development effort in Rust as well. That being said, a system wide cached package repo could work, but it also has issues (looking at you Maven) so it would be interesting to figure out how to get it "right" when dealing with source packages. This old issue discusses a bunch of this: https://github.com/rust-lang/cargo/issues/610 I couldn't find another in a brief search. Edit: I should add that it does harken back a bit to my Gentoo days, where recompiling the world for that 10-15% architecture boost was a lot of fun, but also a waste of time in general ;)

Update: <wycats> Because of this: https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomment-193772935 <wycats> I ran some scenarios against huge repos when I first worked on cargo <wycats> Trying to minimize the cost of operations <wycats> I landed on the current strategy, and GitHub in the above thread more or less endorsed what we were already doing at that time <wycats> Also see https://github.com/rust-lang/cargo/issues/2452

There is a very long comment in the cargo source which explains this decision and some of the trade offs involved. https://github.com/rust-lang/cargo/blob/master/src/cargo/sou... I know that some of the people who worked on cargo originally had experience with other package managers - mainly bundler - and I believe bundler used to use a single file, but ran into performance issues.

The Cargo problem turns out to be a known incompatibility between the version of Cargo which ships with Ubuntu 16.04 LTS and later version of Rust.[1][2][3] "Old versions of cargo cannot install any version of a crate that has a version with a prelease string". It's not the user's .toml file that's the problem; it's an internal dependency within the crate that's breaking Cargo. It's necessary to run Rust's version of Cargo, not Ubuntu's, when using Rust. Due to a path problem, I was using Ubuntu's older versions of Rust and Cargo, but with libraries from the new Rust installation. [1] https://users.rust-lang.org/t/crates-io-compatibility-with-o... [2] https://github.com/rust-lang/crates.io/issues/584 [3] https://github.com/rust-lang/cargo/issues/3763

To be clear, you can use star dependencies locally, but pushing a new crate to `crates.io` will reject crates that have star dependencies. So in some senses this is still accurate, but it's missing the crates.io interaction. This means I don't understand how you got your error. For example: > cat .\Cargo.toml [package] name = "star" version = "0.1.0" authors = ["steveklabnik <steve@steveklabnik.com>"] [dependencies] semver="*" > cargo build Updating registry `https://github.com/rust-lang/crates.io-index` Compiling semver-parser v0.7.0 Compiling semver v0.6.0 Compiling star v0.1.0 (file:///C:/Users/steve/tmp/star) Finished dev [unoptimized + debuginfo] target(s) in 5.24 secs I've filed https://github.com/rust-lang/cargo/issues/3971 I'm also not sure how you got your `join` error, let sline