On Thu, May 25, 2023, 2:55 AM Gregory Heytings <gregory@heytings.org> wrote:

>
> >> Cargo is a program that runs locally, not a server.  It works like
> >> make, except that it may communicate with the crates.io repository, to
> >> fetch a copy of the source code (and the license) of the libraries you
> >> need to build a given Rust program, and that are not yet available
> >> locally.
> >
> > ... akin to npm (the Node package manager of the Javascript world), it
> > downloads half of the Internet while building and makes your life
> > miserable if you want to avoid that.
> >
> > The new models just make it slightly more inconvenient to stay free.
> >
>
> You are spreading FUD.  When you want to compile, say, Emacs, you need to
> either download the binaries of the libraries that are not yet available
> locally and their headers, or download the source of these libraries and
> build them.  Doing that does not "donwload half of the Internet".  After
> this you need to run the "configure" script which checks which libraries
> (and sometimes which versions of these libraries) are available.
>
> Cargo does all that for you.
>
> >
> > Can we call this pattern neo-proprietary?
> >
>
> No, we cannot.  There is no relation whatsoever between software
> proprietariness and this elegant solution to the problem of library
> dependencies.
>


"Elegant" is a strong characterization of the practice of "vendoring"
source dependencies, which you describe here.  It's useful if you are
maintaining a replicable build process common in corporate software
environments and projects meant to distribute prebuilt binaries to the
mass-market.  Vendoring is distinctly unfriendly to users that want to
build or tinker with it locally using locally available (and user-vetted)
libraries, i.e. classic free software users.

Can "crates.io" be replaced by a different package repository, or
configured to work with whatever is available locally?

Lynn