On Thu, May 25, 2023, 2:55 AM Gregory Heytings <gregory@heytings.org> wrote:

>> Cargo is a program that runs locally, not a server.  It works like
>> make, except that it may communicate with the crates.io repository, to
>> fetch a copy of the source code (and the license) of the libraries you
>> need to build a given Rust program, and that are not yet available
>> locally.
>
> ... akin to npm (the Node package manager of the Javascript world), it
> downloads half of the Internet while building and makes your life
> miserable if you want to avoid that.
>
> The new models just make it slightly more inconvenient to stay free.
>

You are spreading FUD.  When you want to compile, say, Emacs, you need to
either download the binaries of the libraries that are not yet available
locally and their headers, or download the source of these libraries and
build them.  Doing that does not "donwload half of the Internet".  After
this you need to run the "configure" script which checks which libraries
(and sometimes which versions of these libraries) are available.

Cargo does all that for you.

>
> Can we call this pattern neo-proprietary?
>

No, we cannot.  There is no relation whatsoever between software
proprietariness and this elegant solution to the problem of library
dependencies.


"Elegant" is a strong characterization of the practice of "vendoring" source dependencies, which you describe here.  It's useful if you are maintaining a replicable build process common in corporate software environments and projects meant to distribute prebuilt binaries to the mass-market.  Vendoring is distinctly unfriendly to users that want to build or tinker with it locally using locally available (and user-vetted) libraries, i.e. classic free software users.

Can "crates.io" be replaced by a different package repository, or configured to work with whatever is available locally?

Lynn