Re: [PROPOSAL] Builder, a build system integration for Emacs

[Jim Porter <jporterbugs@gmail.com>]

On 5/24/2023 2:35 PM, Richard Stallman wrote:
> I think that means it leads people to do their building in someone
> else's server, rather than on your own computer.  For moral reasons,
> that is not good.

I don't think this is true, though I'm not an expert on Cargo. When you 
build your Cargo project via `cargo build`, it will download the source 
code for any dependent libraries from crates.io and then build them all 
on your computer. (The Cargo manual makes this a bit confusing by 
talking about "binary packages", but those are really "packages that 
produce an executable program", not "packages distributed as precompiled 
binaries".)

I suppose it would be possible to distribute precompiled data in some 
form on crates.io (similar to how the Linux kernel has binary blobs), 
but I'm not aware of this happening in practice.

> ISTR that Cargo has a catalog of libraries, some of them nonfree,
> and that this makes it hard to build a Rust package and ensure
> no nonfree library is used.

This I'm not sure about. The documentation[1] says: "The crate registry 
at crates.io distributes the source code of your packages, so it 
primarily hosts code that is open source." The word "primarily" makes me 
somewhat concerned, and I don't see any further documentation on the matter.

For Rust developers who are concerned about licensing of dependencies, 
there's "cargo-deny"[2], which (among other things) lets you ensure that 
your dependencies' licenses are acceptable to you. That requires the 
user to set all this up, but it would then provide an automated way to 
ensure you only use free libraries.

[1] https://doc.rust-lang.org/book/ch14-02-publishing-to-crates-io.html
[2] https://crates.io/crates/cargo-deny