Live data from Hacker News

Cargo, Rust's Package Manager

crates.io

101–110 of 127 posts

Re: Cargo, Rust's Package Manager

#101

While I support semantic versioning, people need to be aware that it's only as good as the package maintainer. I have used packages that have (unintentionally) broke semver conformity. Nothing really stops an author from releasing breaking changes when going from "1.2.1" to "1.2.2".

The goal is to use package manager defaults and community pressure to keep things on the straight and narrow. We'll see how it goes!

Re: Cargo, Rust's Package Manager

#102

Earlier quoted context omitted.

> If it's not going to change, then maybe some outreach should be done to get him to tag it 1.0. Absolutely. Let me make an issue about that: https://github.com/rust-lang/cargo/issues/46 If he doesn't respond, I will email him. > As for the FUDdiness... Thanks! Since the points are enumerated, I can refute them: > * You can't override a dependency: You can, in modern Bundlers. But the transitive dependency issue is i…

I would like to take the opportunity to say that your fast, no-bullshit answers (and actions) are appreciated (in general the Rust community seems to foster this sort of positive attitude, carry on).

Thanks. I have a bit of an... obsessive streak when it comes to these kinds of threads. It works out, though it also means I didn't get a whole lot of other stuff done yet today...

I hope we can keep the Rust community mega positive and no-bullshit. Please let me know if I'm ever not being so.

Re: Cargo, Rust's Package Manager

#103

This is sweet: For example, if I have three packages: - uno depends on json 1.3.6 - dos depends on json 1.4.12 - tres depends on json 2.1.0 Cargo will use json 1.4.12 for uno and dos, and json 2.1.0 for tres. Hopefully rust builds a culture that respects semantic versioning better than the Ruby & Node cultures do. That has to start at the top. There were several Rails 2.3.X releases with minor ABI incompatibilities.…

I don't expect that since the version field is optional.

Re: Cargo, Rust's Package Manager

#104
post #40

Earlier quoted context omitted.

Hmm, well, rust's brew seems a little outdated (0.10), so if you are intent on using Cargo soon, I would recommend on building rust yourself or grabbing a new binary from their website.

There is a homebrew-cask of Rust's nightly binary. I think this should work: brew tap caskroom/cask brew install brew-cask brew tap caskroom/versions brew cask install rust-nightly

Stuff being either in Cask or Homebrew is just terrible. Homebrew also has a versions tap. Those two projects should combine efforts and remove ambiguity.

Re: Cargo, Rust's Package Manager

#105
post #81
post #53

Earlier quoted context omitted.

Don't equate Rails with Ruby (some projects follow semver very closely). Rails follows a shifted semver version, as documented here: https://github.com/rails/rails/blob/master/guides/source/mai... Bumps from 4.x to 4.y might contain smaller breaking changes. For a large project as Rails, I find that reasonable, otherwise, we'd be at Rails 20 by now, which also doesn't quite give a good sense of how the project evolve…

MRI didn't follow semver up until recently, and even now it has some caveats about it. Ruby as an ecosystem doesn't really care for semver. Some projects follow it anyways, which I can respect, but they aren't the norm.

MRI still doesn't follow semver but core doesn't really give a crap.

Re: Cargo, Rust's Package Manager

#106

Earlier quoted context omitted.

> About 14 months ago, it caused some of the most serious vulnerabilities in the Ruby on Rails world ever: http://tenderlovemaking.com/2013/02/06/yaml-f7u12.html Live by eval, die by eval. But more seriously, nobody is forcing a Rust YAML library to support arbitrary structure deserialization (or maybe as an optional switch). I don't think you'd want such a switch on in a build system configuration file.

Then you're not supporting YAML, you're supporting your own subset of YAML.

That's one way to look at it. On the other hand, when a format presents useful, but potentially dangerous characteristics (eg, XML entities expansion), it is entirely sensible to offer a way to not take them into account.

Re: Cargo, Rust's Package Manager

#107
post #105
post #81

Earlier quoted context omitted.

MRI didn't follow semver up until recently, and even now it has some caveats about it. Ruby as an ecosystem doesn't really care for semver. Some projects follow it anyways, which I can respect, but they aren't the norm.

MRI still doesn't follow semver but core doesn't really give a crap.

They claim "Semantic Versioning type" versioning, which is, of course, not SemVer, but I think what your parent was referring to.

https://www.ruby-lang.org/en/news/2013/12/21/ruby-version-po...

Re: Cargo, Rust's Package Manager

#108

Earlier quoted context omitted.

Then you're not supporting YAML, you're supporting your own subset of YAML.

That's one way to look at it. On the other hand, when a format presents useful, but potentially dangerous characteristics (eg, XML entities expansion), it is entirely sensible to offer a way to not take them into account.

Quite fair. Depends on what kind of tradeoff you're looking for: this personally makes me search for a new format. It's reasonable to make a different choice.

Re: Cargo, Rust's Package Manager

#109
post #104

Earlier quoted context omitted.

There is a homebrew-cask of Rust's nightly binary. I think this should work: brew tap caskroom/cask brew install brew-cask brew tap caskroom/versions brew cask install rust-nightly

Stuff being either in Cask or Homebrew is just terrible. Homebrew also has a versions tap. Those two projects should combine efforts and remove ambiguity.

I 100% agree with you. It took me like an hour to figure out where I thought it made sense to put rust-nightly, and I'm still not really sure I did it right. But it works and is way better than the morning compilation cronjob I used to use.
Post reply on HN