> Having Rust installed (recommended way is https://www.rustup.rs/).
This essentially recommends unconditionally using the "curl | sh" anti-pattern.
Shouldn't they recommend instead e.g. "apt-get install rustc" for Debian users?
Since this doesn't make use of too recent Rust features, using Rust 1.14 of Debian/Stable should be fine, shouldn't it? Same of Fedora, etc.
The advantage of this method is that it will work on any linux distro (and even BSD, Darwin and mingw) and you'll get the latest stable version. I don't see the advantage of using potentially outdated OS packages for installing a compiler, it's not like it's a dependency for other packages.
It also makes it easy to manage the various components of the toolchain, for instance if you later want to crosscompile for an other target, use the nightly version etc...
The ship hasn't sailed and neither has the sites without JS one. You have made a decision to favor covenience instead of security and you're trying to make it look like it's the normal state of affairs.
Rust can be installed by downloading the appropriate package and checking it with gpg.
Recommending curling stuff to bash is ridiculous and makes a mockery of the idea of safety.
And of course you can inspect the bash script (not that it does you any good), curl > file; bash file. It's just that most people don't so that's not what is recommended .
The binary will be checked by gpg, it shouldn't matter where it's from.
Finally, if the recommmendation is to run curl foo | sh, the bash script can literally not be inspected.
It's no harder than apt-get install, and sets the best practice early on so that someone doesn't get confused and have to switch later.
"curl | sh" is only an anti-pattern in the sense that you have to trust the source (and therefore "curl | sh" without https is bad). It gives exactly the same ability to execute arbitrary code on your machine as downloading an RPM/DEB does, or adding a vendor specific repo (e.g. Docker). Distro package repos probably have broader scrutiny of the contents of packages, but there are a lot of packages so how sure can you be?
HTTPS is intended for transport security. Using it for package authentication is generally a mistake. That's why most distributions accept the additional complexity of PGP instead of only relying on HTTPS.
Installing an outdated toolchain makes little sense because after this example people interested in Rust may want to do other things, and will encounter an artificial roadblock when they (or a worse, a dependency) needs a newer Rust.
I think the Rust packaged in the distros is meant to be a build-dependency of software written in Rust (for example, ripgrep), not for Rust developers.
That is a RedHat developer blog. Is rust available on RHEL already? Looking at CentOS (which should have nearly the same packages), it doesn't appear to be available yet.
If you're willing to stick with an older version of cargo and rustc, why not?
Thankfully, crates.io lists the dates next to crates so that users can select a version that is released before or during the release cycle of their compiler, thus guaranteeing compatibility.
https://fedoraproject.org/wiki/Changes/Packaging_Rust_applic...