Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cargo, Rust's Package Manager

crates.io

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Cargo, Rust's Package Manager

#61

Post by steveklabnik »

ionforce wrote: post #60
steveklabnik wrote: post #51

Earlier quoted context omitted.

Note that this is a sliiiightly modified SemVer: in SemVer, these three things would conflict. It would be strict SemVer if uno depended on ~>1.3, and dos on ~>1.4. We hypothesize that this difference works better for AOT compiled languages. And since it's pre-1.0, it's all good. This is the 'we'll watch this closely and adjust' from the email: it might not be okay.

Why would uno not work on 1.4?

When you declare an x.y.z dependency, tools that use SemVer (like Bundler, which is the biggest influence on Cargo) assume x.y.(>z). So, a 1.4.12 dependency says "Anything greater than 1.4.12, but less than 1.5.0."

When you declare an x.y dependency, tools that use SemVer assumes x.(>y). So, a 1.4 dependency says "Anything greater than 1.4.anything, but less than 2.anything.anything".

This is assuming the ~> operator, if it was =, it would ONLY be 1.14.2, which is even more restrictive.

The project _should_ work, which is why Cargo is using this modified version of ~>.

Re: Cargo, Rust's Package Manager

#62

Post by Ygg2 »

nimish wrote: post #43
the_mitsuhiko wrote: post #11

Earlier quoted context omitted.

Which ones would that be?

toml is unstable and has no real spec + YAML has a well defined spec and is widely used?

YAML spec is also super complicated and writing parser for it is non-trivial (for comparisson YAML has ~150 EBNF rules while XML with DTD has about ~80)! I'm not comparing validation rules but they are probably about the same.

This complexity means there is already a parser for TOML, and not one for YAML. That's IMO main reason they went with TOML.

Re: Cargo, Rust's Package Manager

#63

Post by steveklabnik »

Ygg2 wrote: post #62
nimish wrote: post #43

Earlier quoted context omitted.

toml is unstable and has no real spec + YAML has a well defined spec and is widely used?

YAML spec is also super complicated and writing parser for it is non-trivial (for comparisson YAML has ~150 EBNF rules while XML with DTD has about ~80)! I'm not comparing validation rules but they are probably about the same. This complexity means there is already a parser for TOML, and not one for YAML. That's IMO main reason they went with TOML.

There are actually already MULTIPLE parsers for TOML in Rust, and Cargo switched between the two yesterday.

As you say, this is a testament to TOML's simplicity.

EDIT: Furthermore, TOML is going to have a 1.0 soon: https://github.com/rust-lang/cargo/issues/46

Re: Cargo, Rust's Package Manager

#64

Post by [deleted] »

steveklabnik wrote: post #49
jpgvm wrote: post #14

I would really love to see some docs on how to actually install and get started with Cargo. It doesn't ship with Rust and the docs on GitHub and crates.io are not very enlightening.

Yesterday started my contract with Mozilla to write documentation. Today, I'm starting on re-writing the tutorial: https://github.com/rust-lang/rust/pull/15131 (apparently, bors is a bit backed up) The new tutorial will be based around 'real' Rust development, and so will assume Cargo. That said, http://crates.io/ should have install instructions on the site. I'll open a ticket and get on that.

[deleted]

Re: Cargo, Rust's Package Manager

#65

Post by thinkpad20 »

steveklabnik wrote: post #48
sigzero wrote: post #41

If someone can log into github and enter a ticket to say no to toml. Yaml would be perfect for it and it is mature and people already know it.

I don't have strong feelings about toml, but the YAML spec is incredibly complicated, and has way too many features for a config file format. And security vulnerabilities O_O

I don't know about the security vulnerabilities, but it works fine as a config file format (we use it at my company for a lot of in-house stuff). I had a similar reaction to the language. Even if not YAML, why not just use JSON? It's universal, dead simple to use and understand, has extensive libraries in just about any language, etc...

That said it's not that big of a deal. At least it's not an in-house markup like Haskell's cabal...

Re: Cargo, Rust's Package Manager

#66

Post by nirvdrum »

steveklabnik wrote: post #59
nirvdrum wrote: post #33

Earlier quoted context omitted.

Not only that, but TOML is still considered unstable by its author. Granted, it hasn't been updated in several months. But that seems like a shaky foundation to be building on top of. From: https://github.com/toml-lang/toml "Latest tagged version: v0.2.0. Be warned, this spec is still changing a lot. Until it's marked as 1.0, you should assume that it is unstable and act accordingly."

While this is true, NOTHING in Rust-land is stable yet, so it's not as big a deal.

That's not really carte blanche to build everything on unstable technology. The point is things are supposed to be converging on stabilization. And a lot of what's unstable now is under the direct control of Rust. What TOML does or doesn't do is now a matter that needs to be worked out with Tom. It's not confidence-inspiring in the least.

If the plan is to jettison TOML, then it's simply just an odd choice to use for a first cut. And from a purely perception manner, seemingly reaffirms concerns some have had about the bundler team building cargo (right or wrong).

Re: Cargo, Rust's Package Manager

#67

Post by steveklabnik »

thinkpad20 wrote: post #65
steveklabnik wrote: post #48

Earlier quoted context omitted.

I don't have strong feelings about toml, but the YAML spec is incredibly complicated, and has way too many features for a config file format. And security vulnerabilities O_O

I don't know about the security vulnerabilities, but it works fine as a config file format (we use it at my company for a lot of in-house stuff). I had a similar reaction to the language. Even if not YAML, why not just use JSON? It's universal, dead simple to use and understand, has extensive libraries in just about any language, etc... That said it's not that big of a deal. At least it's not an in-house markup like…

> I don't know about the security vulnerabilities,

About 14 months ago, it caused some of the most serious vulnerabilities in the Ruby on Rails world ever: http://tenderlovemaking.com/2013/02/06/yaml-f7u12.html

> why not just use JSON?

JSON is not really human-editable. Those quotes and commas, ugh! Also, JSON lacks comments.

The vulnerabilities in YAML (which is a superset of JSON, by the way) point at why YAML and JSON both aren't appropriate for configuration: they are _serialization_ formats. Configuration isn't what they're built for.

And you're right, it's really just not a huge deal in any way. Especially once we have `cargo project` to autogenerate the basics.

Re: Cargo, Rust's Package Manager

#68

Post by steveklabnik »

nirvdrum wrote: post #66
steveklabnik wrote: post #59

Earlier quoted context omitted.

While this is true, NOTHING in Rust-land is stable yet, so it's not as big a deal.

That's not really carte blanche to build everything on unstable technology. The point is things are supposed to be converging on stabilization. And a lot of what's unstable now is under the direct control of Rust. What TOML does or doesn't do is now a matter that needs to be worked out with Tom. It's not confidence-inspiring in the least. If the plan is to jettison TOML, then it's simply just an odd choice to use for…

The plan isn't to jettison TOML, but even though it's 'unstable,' it hasn't changed in a very long time. And, given, uh, Tom, I doubt it will very much. He has better things to do these days.

I can see an argument for INI files, but TOML is basically INI with some extensions. And YAML (which has no Rust parser, and nobody who wnats to write one) and JSON (which does have one in the standard library) are very poor configuration formats.

Which one would you have preferred? It seems like a reasonable choice to me.

> And from a purely perception manner, seemingly reaffirms concerns some have had about the bundler team building cargo (right or wrong).

You could just spell out the personnel issues rather than being all FUDdy about it. (I'm friends with Yehuda, but also was room-mates with the current maintainer of Bundler (until very recently). Bundler isn't perfect, but lots of that had to do with people assuming a pre-1.0 project is stable, and upstream bullshit with RubyGems.)

Re: Cargo, Rust's Package Manager

#69

Post by bjz_ »

FrozenCow wrote: post #22

I haven't been following the development of this package manager, but previous attempts at making a package manager for Rust have failed. Is this package manager supported officially now? I really hope it will stick around.

Yes, it will be supported. The Bundler guys were specifically contracted by Mozilla to sort out the mess. They are actually using Rust in production at the moment, so the have a big stake in its future.

The quiet nature of the development process of Cargo was actually a response to the previous package management failures. The idea was not to publicise heavily before it was ready for dog fooding. This seems to have paid off.

Re: Cargo, Rust's Package Manager

#70

Post by bjz_ »

thinkpad20 wrote: post #65
steveklabnik wrote: post #48

Earlier quoted context omitted.

I don't have strong feelings about toml, but the YAML spec is incredibly complicated, and has way too many features for a config file format. And security vulnerabilities O_O

I don't know about the security vulnerabilities, but it works fine as a config file format (we use it at my company for a lot of in-house stuff). I had a similar reaction to the language. Even if not YAML, why not just use JSON? It's universal, dead simple to use and understand, has extensive libraries in just about any language, etc... That said it's not that big of a deal. At least it's not an in-house markup like…

As a data exchange format, JSON (understandably) has no comments in its grammar. This is a big problem for config files. TOML is actually designed for this kind of thing.
Post reply on HN