re-work readme, add examples for william #9
Conversation
| First you'll need to install `cargo-binstall` either via `cargo install cargo-binstall` (and it'll have to compile, sorry...), or by grabbing a pre-compiled version from the [releases](https://github.com/ryankurte/cargo-binstall/releases) page and putting that somewhere on your path. It's like there's a problem we're trying to solve? | ||
|
|
||
| Once a project supports `binstall` you can then install binaries via `cargo binstall NAME` where `NAME` is the name of the crate. This will then fetch the metadata for the provided crate, lookup the associated binary file, and download this onto your system. | ||
| By default the latest version is installed, which can be overridden using the `--version` argument, and packages are installed to `$HOME/.cargo/bin` as is consistent with `cargo install`, which can be overridden via the `--install-path` argument. As always `--help` will show available options. |
There was a problem hiding this comment.
Could be worth mentioning how you track/manage multi-versions, updates etc.
There was a problem hiding this comment.
hmm i'm not sure how to describe this rn :-/
There was a problem hiding this comment.
So .... you do allow mulitple versions to be installed? Or not?
There was a problem hiding this comment.
it'll clobber anything with the same name atm, extract is just a blind .tgz into output dir...
could specify binary names in the metadata then symlink against em instead which would be dope for atomic updating (and then this would also be an in-app atomic update library lol). it'd be more configuration but, could be optional if not required... recon that's worth the effort?
There was a problem hiding this comment.
Yeah, it probably is. I think homebrew does something similar. Allows fast rollbacks etc.
Something to keep an eye on is tar extraction attacks (../ or symlinks etc).
There was a problem hiding this comment.
Something to keep an eye on is tar extraction attacks (../ or symlinks etc).
yeah the official policy on this is -yolo- at this time, mayybe a confirmation in the default case would be good to eh
how's this @Firstyear? (thanks for the feedback!)