Question: why does dotslash rely on `curl`

[bradzacher]

I can't see it mentioned anywhere in the docs or code comments.
Why does dotslash use curl to do its fetching rather than doing it natively (eg via a crate like reqwest)?

Would be good to document this decision to clarify why there's an implicit dep on curl.

[blakef]

If I were guessing, this has to do with Meta internals being configured correctly for curl out of the box.

[bolinfest]

I agree this should be in the docs.

As a general principle, we prided ourselves on making DotSlash as small as possible (in binary size) and also minimizing the overhead of spawning the underlying executable. (If we failed to do that, I fear some camp would go and try to make a micro-dotslash alternative or something like we see with Vue vs. React, though admittedly there's some combination of hubris and craft at play, as well.)

curl already supports configuration for things like proxies and is battle-tested, to say the least. If we tried to be equally as flexible in configuring how network requests are made in DotSlash, I worry that it would be inferior to curl (or would be yet-another-thing the user might have to configure).

Given that even Windows has committed to making curl available by default, it felt safe to rely upon it and not have to risk any cost for curl/libcurl in the common case where DotSlash is running an executable that is already cached.

Admittedly, from a security perspective, there is some risk that someone sneaks a tainted version of curl onto your $PATH, though if that's the case, (1) you probably have bigger problems, and (2) we still have the content hashes to rely on.

Is the main concern that you have to ensure users have both DotSlash and curl for things to work?

[bradzacher]

I don't have a concern about it using curl - but I did face some friction from folks when I worked to introduce it at Canva. Some people didn't like that it has implicit dependency on the curl and gh binaries instead of linking to libcurl or calling out to the GH APIs by hand.

It wasn't much friction but it was something that I couldn't answer and had to just handwave away and say "I don't know it just does cos curl is battle tested and known to work" which was "good enough" to appease people.

Having an official doc to explain it would make it easy to stave-off such complaints and make it easier to introduce to companies!

FWIW dotslash now forms a core part of our binary distribution tooling at Canva!