Move to Crates.io

[kotauskas]

Since a crate on Crates.io has to only have Crates.io dependencies (or path/SCM dependencies with a Crates.io fallback), using Servo in a crate prevents you from publishing said crate to the registry. What prevents us from releasing the crate there?

[SimonSapin]

Servo has 43 git dependencies (per Cargo.lock, including some not maintained by us), and is itself made of 77 crates (Cargo.toml files outside of tests). Publishing all of these to crates.io and then maintaining them and coordinating releases would be significant additional work.

[kotauskas]

I see. At this point, if I'm understanding this correctly, it's easier to get Crates.io to accept Git dependencies rather than get them all in the registry. Maybe even propose a manifest flag saying that the Git dependencies are intentional and "mean no harm" or something. I still don't fully understand the logic behind their decision to deny all Git-dependent crates.

If I remember right though, the --no-verify flag bypasses manifest checks. Cargo even told me that publishing without a license is possible this way. Perhaps Servo could use this instead. If everything works as I expect it to, Cargo won't check for Servo's Git dependencies in dependents, allowing them to use Servo as a normal Crates.io crate.

[SimonSapin]

crates.io refuses crates that have dependencies that are not on crates.io, because those external dependencies could go disappear at any point. This is unlikely to be relaxed, and I wouldn’t be in favor of that. If I remember correctly this is enforced on the server-side, whereas cargo publish --no-verify can only skip client-side checks.

All in all, we have no short-term plan to have Servo on crates.io, or for Servo to have a supported public Rust API.

[SimonSapin]

Correction: https://github.com/servo/servo/tree/master/ports/libsimpleservo includes a supported Rust API.

[kotauskas]

Not just libsimpleservo. According to this tutorial, you can embed Servo into a GL program out of the box.

[MendyBerger]

Has anything about this changed in the last few years?

Seems like all major dependencies are actually on crates.io.

It would be amazing to be able to just add servo to a project with a simple servo = 0.1 in Cargo.toml. And I think that can also help out a lot with project adoption.

[jdm]

it is impossible to publish mozjs to crates.io at the moment since it contains vendored rust crates.

[MendyBerger]

Pardon me, but I don't see a vendor directory in mozjs

[jdm]

rust-lang/cargo#6917