rustup

It seems like that will change in the (near) future according to the following github issue[0]. A quote from one of the developers, rami3l, in that thread[1]: > My current plan is indeed to remove implicit installations entirely. [0]: https://github.com/rust-lang/rustup/issues/3635 [1]: https://github.com/rust-lang/rustup/issues/3635#issuecomment...

This reminds me of one issue that I've encountered at Rustup. Early versions of ARM64 Pi OS actually use a 32-bit userland. As a result, this has caused user complaints since our installer sees a 64-bit kernel and will happily download a 64-bit binary (which will then refuse to run): https://github.com/rust-lang/rustup/issues/3307#issuecomment...

You may want to reword as "licensed under either GPLv3 or Polyform Non-commercial 1.0 at your option" or some such, like most rust-lang projects do; ex: https://github.com/rust-lang/rustup Then give guidance on why one might choose one license over the other.

Rustup was going to add it, some work was done, and then it was abandoned. This was years ago. https://github.com/rust-lang/rustup/pull/1642

FWIW, there is a proposal to add telemetry to LLVM [0] and Rust used to have telemetry [1], both off by default. Some things in the node.js world have telemetry enabled by default, like Next.js [3]. Some people are posting here as if this is already decided -- AFAICT, that's not the case. It's not even a formal proposal yet, and the stated intent was to start a conversation around something concrete. (For context, this is standard for how the Go project approaches large topics, including for example I think there were something like ~8 very detailed generics design drafts from the core Go team over ~10 years). It sounds like the Go team is going to take some time to look into some of the alternative approaches suggested in the feedback collected so far. In any event, this is obviously a topic people are very passionate about, especially o

I wish Rust would add this, but they don't seem interested at all: https://github.com/rust-lang/rustup/issues/1858

Any software you choose to run could not respect your desires and leave a mess. This is not a random shell script. It's the officially recommended way to install Rust [0], vetted and maintained by the community. You're free to audit the script before running it, or even check out the source [1]. If this doesn't satisfy you, check out the other installation methods [2]. Edit: I realize you're not speaking specifically about rustup, but what I said can and should apply to anything you choose to install this way. 0: https://www.rust-lang.org/tools/install#rustup 1: https://github.com/rust-lang/rustup 2: https://forge.rust-lang.org/infra/other-installation-methods...

This is pretty cool and i think one of the good application areas of distributed ledger technology. Signing is still a hard problem, even for established projects like Rust. Right now, rustup does not verify signatures in any way or form. The security is solely thanks to https and the S3 bucket not being compromised. https://github.com/rust-lang/rustup/issues/2028 https://github.com/rust-lang/rustup/issues/2027

I disable telemetry whenever I can. But the major vendors already use it everywhere (Firefox, vscode, the rust installer, just a few examples) - I've disabled it in all of those, but most don't, and we don't always pay attention to apps that add this as a "feature". Correction: rustup (rust installer) did collect telemetry but it seems to be removed now. https://github.com/rust-lang/rustup/issues/341 The reputation may stick, as we know :) No worries now.

Defender does the scanning on CloseHandle() calls in untrusted code which can block the thread for even up to ~10ms (including other NTFS filter drivers) which is significant if you do open() close() pairs a lot. More info about the similar issue and solution is apparently to sign the application [1] [1] https://github.com/rust-lang/rustup/issues/1540#issuecomment...

> Why didn't the author sign it? Discussed here: https://github.com/rust-lang/rustup.rs/issues/1568 It boils down to that the authors have not gotten around to it and are not experts on Authenticode. Apparently the macOS binary is also not signed, so at least Windows isn't being singled out. To validate your binary you can use the SHA256 checksum that someone posted in the issue two days ago.

Incidentally the copy/rename process can run into issues on Windows due to Windows Defender holding a lock on the file which can prevent it being renamed. This is an issue for the Rust updater utility: https://github.com/rust-lang/rustup.rs/issues/1436

Note that there is an open issue to perform the self-update before the update: [0]. Could be a good first patch for someone looking to contribute :) [0] https://github.com/rust-lang/rustup.rs/issues/1838

The reqwest backend (which uses native-tls and thus schannel and thus the Windows cert store) is the default on Windows, so it shouldn't be using curl. https://github.com/rust-lang/rustup.rs/commit/6389676b6bf211... If you must use an older rustup, set `$env:RUSTUP_USE_REQWEST` (or `$env:RUSTUP_USE_HYPER` for an even older rustup) to `1`