Search code examples
rustrust-cargo

Does `cargo install` download binaries compiled on someone else's computer?

Does cargo install download binaries compiled on someone else's computer? Can it be the case that such pre-builts are sometimes downloaded when executing cargo install? The output of cargo install suggests that compiling takes place, but I am not sure if I can rely that cargo install will never download anything pre-compiled to my computer. Thus, whenever I can I manually clone a repo and compile the binaries myself, .e.g.

git clone https://github.com/mitnk/cicada.git && cd cicada && cargo build --release && sudo mv target/release/cicada /usr/local/bin

instead of installing, e.g. cargo install -f cicada. I only do the former because I would like to avoid downloading binaries compiled on someone else's copmputer? Another reason for this is that I prefer to compile the binaries with --release. I am not quite sure that such optimization takes place when cargo install is executed.

Solution

  • cargo install downloads and compiles the crate locally, using the same mechanisms as when it builds a crate you have downloaded.

    cargo install defaults to release builds. You have to use the --debug flag to build debug builds.

    The build scripts of the crates may download pre-compiled binaries. For example, crates that are bindings to C libraries may download the library. But this is true even if you git clone the source as well.