Félix Saparelli

Okay, so: - there are 30 crates with binstall metadata - zero use plain HTTP - one, `shell-rerun`, has an invalid configuration (binstall metadata with a pkg-url that includes `{...

From this I think we can immediately remove HTTP and be done with it. URLs that are `http://github.com` we can special case to have an override to `https` (plus a...

We can close this now that we've got it forked, I think. We'll want to change back once the upstream merges, but it's no longer a bug here.

I don't know if this bit would be an issue... > The crate does not handle verification of attestations yet but hopefully that's implemented when we get to this

Yeah so this would be the same as `cargo install --git https://....`. Conceptually it would shallow-clone the repo then run as if it was invoked with `--manifest-path cloned-repo`, plus it...

I think with git there's a way in the protocol to only fetch particular files or at least subtrees, which would make it a lot more efficient than cloning the...

I was thinking of names for the strategy, and had the thought that `source` was ambiguous, given the multiple meanings; I think `compile` instead is better?

Yes, that sounds reasonable. `compile` should be allowed as the only option, too; that wouldn't be very useful in principle but I could see it being used in scripts, for...

Yes, that makes a lot more sense, I think. With #3 we'll still want to read the Cargo.toml from the repo, which covers the unpublished crate usecase. Installing from random...

Linux `ping6` is the same thing as `ping` since ~2015 or so, though that may be dependent on packaging (because of course).