[wokwokwok]

> command is that a binary is placed in `~/.cargo/bin`, which most rust programmers will have on their PATH

That is a global effect.

> Nothing, except a user manually running `cargo install --force imgcatr`.

I’m absolutely certain build.rs can also do this; you can choose to ignore that if you want.

I hope ignoring it makes it not a thing we have to ever worry about. I guess.

I get it, it’s convenient; but I think people are fooling themselves if they think having a binary on their path is no big deal, or that manually calling “cargo install” is the only way this can happen.

FWIW, there is a precedent with serde shipping a binary (https://github.com/serde-rs/serde/releases/tag/v1.0.184 related discussion etc. which kind of shows this is not an idle concern)… mmm… oh well, whatever I guess.

[gpm]

> That is a global effect.

Yes, I agree, that's why I said it is the only one. Moreover the sole purpose of cargo install is to cause that side effect (otherwise you use cargo build, which builds the binaries but doesn't copy them to a shared directory).

> I’m absolutely certain build.rs can also do this

build.rs is running arbitrary code, it can do anything, that's part of what I disclaimed in my asterix. In practice it doesn't do anything. Every packaging system has an escape hatch like this.

Serde shipping a binary was someone embedding a chunk of opaque bytes in their "source code", it's completely unrelated to this discussion and has no effect on what `cargo install` does.