Would we want to use `rustup`?
Yes.
So to use this, I have to kill my local Rust toolchain?
That's not a "local" rust toolchain. That's the distro-provided global toolchain.
You would remove the distro packages of `rustc` and `cargo` and use rustup instead. Rustup is a toolchain manager; It allows you to install multiple toolchain versions side-by-side, instead of just the 1 version the distro provides.
(I would hope Go has something comparable for managing multiple toolchain installs.)
And I thought, nice, it's compiling from source. But isn't the Rust com- piler written in Rust? didn't I just delete my Rust compiler? I suppose the toolchain was downloaded as binary.
- rustup downloads toolchains as binaries - cargo downloads and builds crates from source
Then it went on with the next `rustup` command. Looked about the same, but what? aren't these the same packages it's compiling? Looking at the running processes, they were. But to my surprise nothing changed in my .cargo directory. Could still be that something was statically linked and the artifacts removed.
Crates are mostly statically linked. Even if different crates use the same dependency, they are part of separate projects are so are rebuild. Other considerations are they may use different versions of the same dep, or enable different features. `cargo install` will compile crates in `/tmp`.
- Currently we have a chain of trust:
If we surrender the control about what to download (and install and run) to another program, we should probably warn the user. I had a quick look at `rustup` and `cargo` and couldn't find an answer if things can be specified by hash. I hope they can.
- our Git repository and the checked out commit (hash)
- hashes for files to download (e.g. for the GCC sources)
- those are checked into the repository
It's not hashes, but projects can use a `rust-toolchain.toml` file to control the exact Rust version used. e.g.:
[toolchain] channel = "nightly-2023-09-07" components = ["clippy", "rust-src", "rustfmt"]
So regardless of the distro you're on, the same version of the toolchain is used.
- So far we built everything (that was added on top of the user's OS distribution) from source. I think we should be proud of that.
Building from source is just a means to an end: Ensuring the same version of the toolchain is always used. `rust-toolchain.toml` accomplishes this for Rust projects.