Perfecting Rust Packaging

This has been the rule for most other module ecosystems in the Linux distros (Python, CPAN, Eclipse modules to name just a few; Fedora even repackages node.js packages despite the strong preference for bundled dependency installation in npm). They do want to reflect both build dependencies and binary dependencies in the respective source/binary packages, avoid downloading in builds, and discourage library bundling.

I think the main reason for that is maintainability on the distribution level. If a library crate X is found to have a critical bug, they don't have practical ways to comb through the entire package universe searching for Cargo build manifests listing that library as a dependency, let alone projects that don't even use Cargo. All they have is their package database, so the bundling of crates should be reflected as build dependencies in the packages.

1 Like