The main differences which are important to me are:
- Cryptographic signatures and a chain of trust.
- A clear understanding of what is installed.
- Updates for security and otherwise.
Cryptographic Signatures and a Chain of Trust
While using TLS/HTTPS for serving your arbitrary shell script achieves the cryptographic property of authentication usually in the cipher configuration, cryptographic signatures like those provided by GnuPG provide both authentication and non-repudiation. Since Rust uses Keybase, it’s easy to get access to Rust’s PGP key and validate certain proofs about it, ie that whoever controls the rust-lang.org DNS also controls the PGP key, etc.
Adding a simple PGP signature to the rustup installer shell script would be a move in the right direction, but it doesn’t address further concerns.
Installation and Package Ownership
On both Debian and RPM-based systems, it’s trivial to query what a package provides for a given system. I can easily ask the package manager intelligent questions like “which package owns this file?” and more. I can also view logs of when said package was installed, when it was upgraded, etc. All these come for free when a repository is made.
Updates: Security and Otherwise
If I’ve installed rustup via curl | sh and a significant or not-so-significant security problem is found in rustup, I’m on my own. It’s up to me to follow forums, Rust’s twitter, an email list, or something else. Until I find out that there was a problem, I’m living with insecure software. Yes, Rust doesn’t suffer from a lot of security problems, but they still happen.
With a repository, a new package can be issued and pushed out and users will receive the newer version of the package. Some package managers allow tagging certain releases as security-related fixes and these can be automatically upgraded as security issues are found.
All of this is truly beyond the point, though. @comex it seems like you’re advocating for a world before package management was invented. The reasons listed above and so many other ones apply here. Package managers exist for a reason, and Rust would do well to at the least package rustup for the common distributions.
It’s not at all unreasonable to want to see PGP signatures, establish trust in what we are installing, and get updates in a timely fashion. Our distributions do that for us, and I am happy to volunteer my time to help get rustup packaged in Debian packages for latest Debian, Ubuntu LTS and recent releases, RHEL 6/7, and recent Fedora versions.
We lose nothing by doing this except the time which I’m willing to volunteer, and we gain a lot by this.
