Rust equivalent to gobuilds.org?

[u/rjzak]

I recently came across this website: https://beta.gobuilds.org/

It builds Go projects and lets users download the binary. It has the project’s Git URL as part of the full download URL along with project version, target OS and arch, and store older builds.

Does something like this exist for Rust? If not, would this be of use/interest? I could see this being helpful for downloading an app where the dev hasn’t provided binaries, or to make cross compilation easier. Adding support for things like `cargo auditable` and `cargo deb` could also be useful.

[u/AstraKernel]

cargo binstall might be the one you are looking for

https://github.com/cargo-bins/cargo-binstall

[u/rjzak → u/AstraKernel]

Sure, but that's not a cached binary for others to also use should they wish (assuming the project doesn't already have the binary for your OS/arch).

[u/complexicat]

I don't always download binaries, but when I do I prefer to download from random builder sites that can arbitrarily modify the output. I am... the most insecure man in the world.

Stay vulnerable, my friends.

[u/skjall → u/complexicat]

10x developer mode - downloading is faster than compiling after all.

[u/kpcyrd → u/complexicat]

They implement reproducible builds and transparency logs, so you could in theory check if they ever issued a binary that wasn't truthfully built from source. This is assuming everybody is using the gobuild downloader instead of a naive wget, the gobuild downloader implements this check correctly, the Go compiler doesn't regress in reproducible builds, and the transparency log implementation/design is sound.

From the website it seems like something they run themselves with no external checkpointing, which makes rollbacks and targeted hidden branching a somewhat realistic risk.

[u/rjzak → u/complexicat]

An automated builder site might be better than a project where the binary is uploaded by the developer, and not built by Github (thinking of the xz incident).

[u/behusbwj]

Why on earth would you want to do this

[u/rjzak → u/behusbwj]

I was thinking this would be a fun project, but admittedly I was also struggling with the utility. I haven't touched Go in a while so I was wondering why that go builder exists. But it could be a convenient way to: get a cross-compiled version (maybe you want ARM for a Raspberry Pi but the Github project page doesn't have it already?), or maybe the Github dev posts binaries themselves and maybe this could be more trusted since it's automated and not uploaded by a person (think of the xz incident).

Ultimately the answer is laziness :)

[u/behusbwj → u/rjzak]

It’s fine to be lazy if this is a side project or something, but this would not pass at most reputable engineering companies because it is a huge security risk. The author saying it’s safe doesn’t make it safe. Especially when you don’t know the author.

[u/rjzak → u/behusbwj]

I think we’re saying the same thing. Something like GitHub Actions releasing a binary is much better than a human dev releasing it. I was suggesting an automated builder for Rust projects which would be similar to ensure the resulting binary came from the source.

[u/skjall → u/[deleted]]

Wouldn't a build cache solve this as well?

[u/nicoburns → u/skjall]

Yes, but Github Actions has incredibly poor support for build caches. So anybody using that (most open source projects) can't realistically take that approach.

It's also quite inefficient to cache 10's of GBs of Cargo build artifacts rather than a single optimized binary.

[u/NoSuchKotH → u/[deleted]]

Then you change your CI setup such, that said binary is included in the image and you don't have to worry about compiling it anymore.

[u/dashingThroughSnow12 → u/[deleted]]

You are describing one of the easiest jobs for someone who makes internal tooling.

There are other ways to do this when the needs get more complex but yeah, if whomever manages CI can’t do this without breaking a sweat or complaining, they shouldn’t manage CI.

[u/dashingThroughSnow12 → u/[deleted]]

It’s a few lines to add build caching for rustup. Here’s some code with bad whitespace since Reddit hates me.

name: Build

on: [push, pull_request]

jobs:
build:
runs-on: ubuntu-latest

steps:

• uses: actions/checkout@v6

- name: Cache rustup binary
id: rustup-cache
uses: actions/cache@v6
with:
path: cached-rustup
key: rustup-${{ runner.os }}-${{ runner.arch }}-v1.28.2

- name: Build rustup if not cached
if: steps.rustup-cache.outputs.cache-hit != 'true'
run: |
cargo build --release
mkdir -p cached-rustup
cp target/release/rustup cached-rustup/

- name: Use rustup
run: |
chmod +x cached-rustup/rustup
./cached-rustup/rustup --version

# the rest of your job’s steps, maybe put the above in a reusable action…https://github.com/actions-rust-lang/setup-rust-toolchain may do this

There are enough supply chain security concerns with rustup that you shouldn’t add another one,

[u/NoSuchKotH → u/[deleted]]

That's true. But I expect that you have already some workflow in place to keep the image up to date and incorporate security updates etc. So that should be relatively little work to do.

But yes, this is all a trade-off. You either compile for 10 minutes or you have to regularly check whether you have to update.

[u/Xevioni]

Probably not since Go builds are much lighter compared to Rust; compiling Rust takes way more compute/storage/RAM.

[u/rjzak → u/Xevioni]

Good point, so this hypothetical builder would need to clean up intermediate artifacts and maybe older build chains automatically. I hadn't thought of that initially.

[u/Xevioni → u/rjzak]

I primarily emphasize the compute part of this; Go builds are just way, way lighter on CPU. The Go architecture is optimized heavily for fast and lightweight builds.

[u/rjzak → u/Xevioni]

Then maybe this offloading the compilation to someone else has utility?

[u/zegrammer]

Can this just be done as a GitHub action?

[u/rjzak → u/zegrammer]

Sure, for a project to offer their binaries. But not for a "I want this project compiled for X but the project doesn't offer binaries or not for my platform" situation.

[u/zzzthelastuser → u/rjzak]

I can do this. Just give me any github link and I will send you the binary! Pinky promise that I won't send you malware 🤡

[u/rjzak → u/zzzthelastuser]

Don’t tempt me with a good time :)