Simplify download abstractions and start warning about curl usage

Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "rustup"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
+version = "1.28.1"
+edition = "2024"
+license = "MIT OR Apache-2.0"
 description = "Manage multiple rust installations with ease"
 homepage = "https://github.com/rust-lang/rustup"
 keywords = ["rustup", "multirust", "install", "proxy"]
@@ -11,13 +11,19 @@ repository = "https://github.com/rust-lang/rustup"
 build = "build.rs"
 
 [features]
-curl-backend = ["download/curl-backend"]
+curl-backend = ["dep:curl"]
 default = ["curl-backend", "reqwest-native-tls", "reqwest-rustls-tls"]
 
 vendored-openssl = ['openssl/vendored']
 
-reqwest-native-tls = ["download/reqwest-native-tls"]
-reqwest-rustls-tls = ["download/reqwest-rustls-tls"]
+reqwest-native-tls = ["reqwest/native-tls", "dep:reqwest", "dep:env_proxy"]
+reqwest-rustls-tls = [
+  "reqwest/rustls-tls-manual-roots-no-provider",
+  "dep:env_proxy",
+  "dep:reqwest",
+  "dep:rustls",
+  "dep:rustls-platform-verifier",
+]
 
 # Include in the default set to disable self-update and uninstall.
 no-self-update = []
@@ -35,16 +41,17 @@ test = ["dep:walkdir"]
 
 # Sorted by alphabetic order
 [dependencies]
-anyhow.workspace = true
+anyhow = "1.0.69"
 cfg-if = "1.0"
 chrono = { version = "0.4", default-features = false, features = ["std"] }
 clap = { version = "4", features = ["derive", "wrap_help"] }
 clap_complete = "4"
-download = { path = "download", default-features = false }
+curl = { version = "0.4.44", optional = true }
 effective-limits = "0.5.5"
 enum-map = "2.5.0"
+env_proxy = { version = "0.4.1", optional = true }
 flate2 = "1"
-fs_at.workspace = true
+fs_at = "0.2.1"
 git-testament = "0.2"
 home = "0.5.4"
 itertools = "0.14"
@@ -53,36 +60,39 @@ opener = "0.7.0"
 # `openssl` is used by `curl` or `reqwest` backend although it isn't imported by rustup: this
 # allows controlling the vendoring status without exposing the presence of the download crate.
 openssl = { version = "0.10", optional = true }
-opentelemetry = { workspace = true, optional = true }
-opentelemetry-otlp = { workspace = true, optional = true }
-opentelemetry_sdk = { workspace = true, optional = true }
+opentelemetry = { version = "0.29", optional = true }
+opentelemetry-otlp = { version = "0.29", features = ["grpc-tonic"], optional = true }
+opentelemetry_sdk = { version = "0.29", features = ["rt-tokio"], optional = true }
 pulldown-cmark = { version = "0.13", default-features = false }
 rand = "0.9"
 regex = "1"
 remove_dir_all = { version = "1.0.0", features = ["parallel"] }
+reqwest = { version = "0.12", default-features = false, features = ["blocking", "gzip", "socks", "stream"], optional = true }
 retry = { version = "2", default-features = false, features = ["random"] }
 rs_tracing = { version = "1.1", features = ["rs_tracing"] }
+rustls = { version = "0.23", optional = true, default-features = false, features = ["logging", "aws_lc_rs", "tls12"] }
+rustls-platform-verifier = { version = "0.5", optional = true }
 same-file = "1"
 semver = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 sha2 = "0.10"
 sharded-slab = "0.1.1"
 strsim = "0.11"
 tar = "0.4.26"
-tempfile.workspace = true
-termcolor.workspace = true
-thiserror.workspace = true
+tempfile = "3.8"
+termcolor = "1.2"
+thiserror = "2"
 threadpool = "1"
-tokio.workspace = true
-tokio-retry.workspace = true
-tokio-stream.workspace = true
+tokio = { version = "1.26.0", default-features = false, features = ["macros", "rt-multi-thread", "sync"] }
+tokio-retry = "0.3.0"
+tokio-stream = "0.1.14"
 toml = "0.8"
-tracing.workspace = true
-tracing-opentelemetry = { workspace = true, optional = true }
-tracing-subscriber = { workspace = true, features = ["env-filter"] }
-url.workspace = true
+tracing = "0.1"
+tracing-opentelemetry = { version = "0.30", optional = true }
+tracing-subscriber = { version = "0.3.16", features = ["env-filter"] }
+url = "2.4"
 wait-timeout = "0.2"
-walkdir = { workspace = true, optional = true }
+walkdir = { version = "2", optional = true }
 xz2 = "0.1.3"
 zstd = "0.13"
 
@@ -115,49 +125,20 @@ version = "0.59"
 
 [dev-dependencies]
 enum-map = "2.5.0"
-platforms.workspace = true
-proptest.workspace = true
-tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+http-body-util = "0.1.0"
+hyper = { version = "1.0", default-features = false, features = ["server", "http1"] }
+hyper-util = { version = "0.1.1", features = ["tokio"] }
+platforms = "3.4"
+proptest = "1.1.0"
 trycmd = "0.15.0"
 
 [build-dependencies]
-platforms.workspace = true
-
-[lints]
-workspace = true
-
-[workspace]
-members = ["download"]
-
-[workspace.package]
-version = "1.28.1"
-edition = "2024"
-license = "MIT OR Apache-2.0"
-
-[workspace.dependencies]
-anyhow = "1.0.69"
-fs_at = "0.2.1"
-opentelemetry = "0.29"
-opentelemetry-otlp = { version = "0.29", features = ["grpc-tonic"] }
-opentelemetry_sdk = { version = "0.29", features = ["rt-tokio"] }
 platforms = "3.4"
-proptest = "1.1.0"
-tempfile = "3.8"
-termcolor = "1.2"
-thiserror = "2"
-tokio = { version = "1.26.0", default-features = false, features = ["macros", "rt-multi-thread"] }
-tokio-retry = { version = "0.3.0" }
-tokio-stream = { version = "0.1.14" }
-tracing = "0.1"
-tracing-opentelemetry = "0.30"
-tracing-subscriber = "0.3.16"
-url = "2.4"
-walkdir = "2"
 
-[workspace.lints.rust]
+[lints.rust]
 rust_2018_idioms = "deny"
 
-[workspace.lints.clippy]
+[lints.clippy]
 # `dbg!()` and `todo!()` clearly shouldn't make it to production:
 dbg_macro = "warn"
 todo = "warn"

ci/run.bash

@@ -50,10 +50,18 @@ target_cargo() {
 
 target_cargo build
 
-download_pkg_test() {
-  features=('--no-default-features' '--features' 'curl-backend,reqwest-native-tls')
+# Machines have 7GB of RAM, and our target/ contents is large enough that
+# thrashing will occur if we build-run-build-run rather than
+# build-build-build-run-run-run. Since this is used solely for non-release
+# artifacts, we try to keep features consistent across the builds, whether for
+# docs/test/runs etc.
+build_test() {
+  cmd="$1"
+  shift
+
+  features=('--features' 'curl-backend,reqwest-native-tls')
   case "$TARGET" in
-    # these platforms aren't supported by ring:
+    # these platforms aren't supported by aws-lc-rs:
     powerpc* ) ;;
     mips* ) ;;
     riscv* ) ;;
@@ -62,23 +70,11 @@ download_pkg_test() {
     * ) features+=('--features' 'reqwest-rustls-tls') ;;
   esac
 
-  cargo "$1" --locked --profile "$BUILD_PROFILE" --target "$TARGET" "${features[@]}" -p download
-}
-
-# Machines have 7GB of RAM, and our target/ contents is large enough that
-# thrashing will occur if we build-run-build-run rather than
-# build-build-build-run-run-run. Since this is used solely for non-release
-# artifacts, we try to keep features consistent across the builds, whether for
-# docs/test/runs etc.
-build_test() {
-  cmd="$1"
-  shift
-  download_pkg_test "${cmd}"
   if [ "build" = "${cmd}" ]; then
-    target_cargo "${cmd}" --workspace --all-targets --features test
+    target_cargo "${cmd}" --workspace --all-targets "${features[@]}" --features test
   else
-    target_cargo "${cmd}" --workspace --features test --tests
-    target_cargo "${cmd}" --doc --workspace --features test
+    target_cargo "${cmd}" --workspace "${features[@]}" --features test --tests
+    target_cargo "${cmd}" --doc --workspace "${features[@]}" --features test
   fi
 }