Maintain reasonable MSRV so that this has chance of being packaged in distros about cargo-crev HOT 2 CLOSED

If distros prefer to package old versions of Rust and Cargo, I suggest they should also package old versions cargo-crev.

We need to keep the cargo dependency relatively up to date, as otherwise we risk problems with parsing Cargo.toml of crates that use newer Cargo features (and probably other files like .cargo/config or registry cache). Cargo only cares about supporting the latest-stable Rust. In practice it's sometimes compatible with a few versions behind, but nowhere near as old as Debian requires. Many other dependencies don't support Debian either.

I'm afraid that Debian's situation is hopeless and unfixable. Debian has its own reasons for keeping software "stable", and the Rust project has its own reasons for keeping software "evergreen". It doesn't matter which is the better approach, but they just don't work together. Trying to satisfy both opposing strategies creates a lot of tension and extra work for everybody involved. The situation is pretty bad and won't get better until either Debian starts updating Rust frequently, or the Rust project starts designating some LTS versions.

from cargo-crev.

Oh, crap, good point about cargo dependency. Even packaging older version is not great for the same reason.

The only other viable approach I see is to release signed binaries and perhaps have a small program that can automatically download and upgrade them. This program itself could be packaged (not sure if it could in official Debian repo though). I've seen a similar technique employed by torbrowser on whonix - they also can't package it properly for reason I don't know but the way it works is if you apt upgrade the dummy package it'll just download the latest torbrowser in postinst.

from cargo-crev.