Conversation

Jarkko Sakkinen

Edited 1 year ago

Installing #rustup:

alias rustup="curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | bash -s --"

E.g.

rustup --no-modify-path

Just though that good to write this up since I see some distributions packaging rustup, which makes no sense (for #rustc and #cargo it does for obvious reasons).

It is also totally safe to run rustup this way kudos to the amazing #TLS 1.2.

#rustlang

2
1
1

This also shows that Rust main site maintainers have really thought the integrity here so that it is easy for user and fairly secure. Theres a reason why --proto '=https' --tlsv1.2 is there, unlike in many other projects. Gives guarantees.

0
0
0

@jarkko Piping curl to bash is secure as long as you trust the server sends you genuine data.

And here's how a server can detect a "curl | bash":
https://web.archive.org/web/20230713101658/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

0
0
0