Pip and cargo are not the same

1. crates.io-index

   1 40 600 10.0 Roff

   Registry index for crates.io

   

   > If I'm not mistaken, it needs to download a package to know its dependencies and version constraints.

   It's even worse than that. It needs to execute a python script (setup.py?) per package to get a list of it's dependencies and constraints. As that script may contain arbitrary platform-dependent logic (and in the case of ML-related packages often does), which means that it can be impossible to resolve dependencies for other platforms.

   > Not sure how other package managers avoid that. Maybe the central package repositories can expose the dependencies metadata without needing to download the actual package?

   Yes exactly.

   For dependency resolution, cargo uses only a git based index[0] which is optimized to contain only the information required for dependency resolution (omitting other package metadata such as e.g. authors). So it syncs the git repository and after that it is just lookups in local files of the index.

   Only after dependency resolution does it need to consult an external server for retrieval of the actual package contents.

   [0]: https://github.com/rust-lang/crates.io-index

2. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. rdfind

   2 18 1,008 7.1 C++

   find duplicate files utility

   I use rdfind to deal with this: https://github.com/pauldreik/rdfind

4. fclones

   3 17 2,049 6.0 Rust

   Efficient Duplicate File Finder

   Yes, that would be safer when available (although generally files within library dependencies are not modified I think?). It looks like fclones implements this, is faster and is written in Rust https://github.com/pkolaczk/fclones (the last is the most important point of course /s).

5. cargo-crev

   4 55 2,126 7.5 Rust

   A cryptographically verifiable code review system for the cargo (Rust) package manager.

   

   There is a similar idea being explored with https://github.com/crev-dev/cargo-crev - you trust a reviewer who reviews crates for trustworthiness, as well as other reviewers.

Suggest a related project