Re: [PATCH 2/2] cargo.eclass: use direct CDN urls for crates.io

Sam James <[email protected]> Fri, 29 May 2026 07:41:40 +0100
Newsgroups gmane.linux.gentoo.devel
Organization Gentoo
Message-ID <[email protected]>
Eli Schwartz <[email protected]> writes:

> There are four reasons for doing this:
>
> - it is the destination of a redirect at the urls we previously used, so
>   less work
>
> - per https://blog.rust-lang.org/2024/03/11/crates-io-download-changes/
>   the API is "slow and expensive" and cargo now uses the CDN directly,
>   too; all third-party "build systems" are recommended to do so as well
>
> - crates.io/api has started banning download agents that don't suitably
>   identify themselves, and curl/wget without --user-agent fail. This
>   will also be fixed by https://github.com/gentoo/portage/pull/1585
>   however that depends on users not manually setting FETCHCOMMAND
>   with naive (no user-agent) values, nor using pk pkg env and
>   copy/pasting.

Bug: https://bugs.gentoo.org/682610
Bug: https://bugs.gentoo.org/976165

>
> - shorter urls *plus* lack of need for arrow renaming will nontrivially
>   reduce the size of SRC_URI
>
> Signed-off-by: Eli Schwartz <[email protected]>


Reviewed-by: Sam James <[email protected]>

> ---
>  eclass/cargo.eclass | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/eclass/cargo.eclass b/eclass/cargo.eclass
> index 18cb2156cc8f..9ce135b5ef4b 100644
> --- a/eclass/cargo.eclass
> +++ b/eclass/cargo.eclass
> @@ -296,7 +296,7 @@ _cargo_set_crate_uris() {
>  			name="${BASH_REMATCH[1]}"
>  			version="${BASH_REMATCH[2]}"
>  		fi
> -		url="https://crates.io/api/v1/crates/${name}/${version}/download -> ${name}-${version}.crate"
> +		url="https://static.crates.io/crates/${name}/${nam}-${version}.crate"
>  		CARGO_CRATE_URIS+="${url} "
>  
>  		# when invoked by pkgbump, avoid fetching all the crates
signature.asc (application/pgp-signature, 418 B)
-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmoZNSQbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkIGO
AQCaJTxqFd+CS7D6j8LKclfOGFWvmiuMZFQYImZX9eSMsAD/fbDxJXVsxtWFzDyM
6jwEwdDGFuRFdggy3ju10oqfHgY=
=hd4D
-----END PGP SIGNATURE-----