Pip and cargo are not the same

• crates.io-index

  39 536 10.0 Shell

  Registry index for crates.io

  

> If I'm not mistaken, it needs to download a package to know its dependencies and version constraints.

It's even worse than that. It needs to execute a python script (setup.py?) per package to get a list of it's dependencies and constraints. As that script may contain arbitrary platform-dependent logic (and in the case of ML-related packages often does), which means that it can be impossible to resolve dependencies for other platforms.

> Not sure how other package managers avoid that. Maybe the central package repositories can expose the dependencies metadata without needing to download the actual package?

Yes exactly.

For dependency resolution, cargo uses only a git based index[0] which is optimized to contain only the information required for dependency resolution (omitting other package metadata such as e.g. authors). So it syncs the git repository and after that it is just lookups in local files of the index.

Only after dependency resolution does it need to consult an external server for retrieval of the actual package contents.

[0]: https://github.com/rust-lang/crates.io-index

• rdfind

  16 871 4.9 C++

  find duplicate files utility

I use rdfind to deal with this: https://github.com/pauldreik/rdfind

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• fclones

  17 1,711 6.8 Rust

  Efficient Duplicate File Finder

Yes, that would be safer when available (although generally files within library dependencies are not modified I think?). It looks like fclones implements this, is faster and is written in Rust https://github.com/pkolaczk/fclones (the last is the most important point of course /s).

• cargo-crev

  55 2,030 7.9 Rust

  A cryptographically verifiable code review system for the cargo (Rust) package manager.

  

There is a similar idea being explored with https://github.com/crev-dev/cargo-crev - you trust a reviewer who reviews crates for trustworthiness, as well as other reviewers.

Suggest a related project