Direct link to download published crate sources

[dhardy]

A couple of times now I have wanted to download the source for a published crate. Sometimes a link to the code repository is all you need, but sometimes the link is missing (or there isn't even a published repository), and sometimes you need to inspect the exact code of a release.

Since Cargo publications are just source tarballs, inspecting the .crate files is easy if you can get them, however apparently the only way to do this is to make Cargo download the crate as a dependency, then retrieve it from Cargo's cache.

Summary: add a direct download link for each published .crate file.
Related: #193

[sgrif]

I don't think this is a common enough need to justify a link on the website. You can download any crate by just going to crates.io/api/v1/crates/crate_name/vers/download (e.g. https://crates.io/api/v1/crates/diesel/1.3.3/download)

[dhardy]

Thanks, but that's quite a URL to remember. I would prefer a link on the page (or maybe under the "all versions" page).

[Turbo87]

as described in e.g. #2113 and some of the other linked issues, our official recommendation is to use tools like https://github.com/JanLikar/cargo-clone to download the raw source of crates if you need them, or use our API endpoint for it directly.

since the mainstream way of downloading crates is always going to be cargo usage, a prominent "Download" button on the page could cause quite a bit of confusion to our users. since downloading a .crate file manually is a relatively uncommon thing and there are already cargo plugins that allow this, we don't think the tradeoff of having such a button is worth it.

[pragmatrix]

a prominent "Download" button on the page could cause quite a bit of confusion to our users

Agreed, but there is also lies the solution, don't make a download button prominent. The users needing it will find it, the ones who don't, won't be confused.

[WhyNotHugo]

since downloading a .crate file manually is a relatively uncommon thing

How do you typically review code before you run it locally if not by downloading the tarball?

[eth3lbert]

How do you typically review code before you run it locally if not by downloading the tarball?

I have shown two approaches for inspecting the contents at #10754 (reply in thread).

[WhyNotHugo]

Navigating through HTML renders of a codebase is hardly a convenient way to read an entire codebase. Don't you really not use a code editor or IDE?

Both of these options seem like (rather hacky) workarounds, but are not substitute for a simple "download" button.

[WhyNotHugo]

FWIW, most other package repositories include links to download tarballs, even though they are not necessary when using a package manager. Some random examples:

• https://pypi.org/project/cryptography/
• https://archlinux.org/packages/extra/x86_64/python-cryptography/
• https://packages.debian.org/bookworm/amd64/python3-cryptography

It doesn't need to be a huge prominent link, just something that's findable with ctrl+f would suffice.