I've thought more about this... While this is still a concern to me, it's a concern for any crates.io C-library wrapper, and is not specific to how Cargo is implemented. And on the other hand, a crate that ran git
or curl
externally would be coupled to the narrow command-line interface, and would insulate its clients in the same way as I suggested a scripting-language would. The concern here is (almost) orthogonal to Cargo's implementation language, since Cargo could be written to invoke these tools externally.