original spec for cargo quickinstall client

[alsuren]

cargo quickinstall $package should:

• Attempt to fetch precompiled binaries for $package if they exist.
  • Download from bintray.com.
  • Ask an external notary for the hash of any tarball that we download from github releases #56
  • Somehow update ~/.cargo/.crates2.toml and ~/.cargo/.crates2.json? #54
  • Report the cargo quickinstall invocation to the stats server
• Fall back to running cargo install $package.
  • Report statistics of how long it took to install, and how big the resulting binaries are. #55

[alsuren]

After talking to my housemate about threat models, I don't think the signatures thing really closes any attack vectors. It might be interesting to ask an external notary to tell us the hash of the tarball from github-releases when we download it. We could then know whether it has ever changed.

[alsuren]

I have split everything else out, so I'm closing this issue.