From 650b0d5beda9aa71a9c11fb8f276349c498f59a9 Mon Sep 17 00:00:00 2001
From: Christof Weickhardt <christof@weickhardt.ch>
Date: Sun, 1 May 2022 12:46:30 +0000
Subject: [PATCH] feat: flags to disable third-party and from source installs

---
 src/bins.rs     |  4 +++-
 src/fetchers.rs | 22 ++++++++++++----------
 src/main.rs     | 25 +++++++++++++++++++++++--
 3 files changed, 38 insertions(+), 13 deletions(-)

diff --git a/src/bins.rs b/src/bins.rs
index d3b6468b..3000df5e 100644
--- a/src/bins.rs
+++ b/src/bins.rs
@@ -47,7 +47,9 @@ impl BinFile {
         let dest = data.install_path.join(dest_file_path);
 
         // Link at install dir + base-name{.extension}
-        let link = data.install_path.join(&ctx.render("{ bin }{ binary-ext }")?);
+        let link = data
+            .install_path
+            .join(&ctx.render("{ bin }{ binary-ext }")?);
 
         Ok(Self {
             base_name,
diff --git a/src/fetchers.rs b/src/fetchers.rs
index e4474f12..1f8cdc18 100644
--- a/src/fetchers.rs
+++ b/src/fetchers.rs
@@ -52,17 +52,19 @@ impl MultiFetcher {
         self.fetchers.push(fetcher);
     }
 
-    pub async fn first_available(&self) -> Option<&dyn Fetcher> {
+    pub async fn first_available(&self, allow_third_party_sources: bool) -> Option<&dyn Fetcher> {
         for fetcher in &self.fetchers {
-            if fetcher.check().await.unwrap_or_else(|err| {
-                debug!(
-                    "Error while checking fetcher {}: {}",
-                    fetcher.source_name(),
-                    err
-                );
-                false
-            }) {
-                return Some(&**fetcher);
+            if allow_third_party_sources || !fetcher.is_third_party() {
+                if fetcher.check().await.unwrap_or_else(|err| {
+                    debug!(
+                        "Error while checking fetcher {}: {}",
+                        fetcher.source_name(),
+                        err
+                    );
+                    false
+                }) {
+                    return Some(&**fetcher);
+                }
             }
         }
 
diff --git a/src/main.rs b/src/main.rs
index 3ec69068..8bfcb226 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -50,6 +50,14 @@ struct Options {
     #[structopt(long)]
     no_cleanup: bool,
 
+    /// Do not allow installs from third party sources such as quickinstall
+    #[structopt(long)]
+    no_third_party_sources: bool,
+
+    /// Disable fallback installation via `cargo install`
+    #[structopt(long)]
+    disable_cargo_install: bool,
+
     /// Override manifest source.
     /// This skips searching crates.io for a manifest and uses
     /// the specified path directly, useful for debugging and
@@ -161,7 +169,11 @@ async fn main() -> Result<(), anyhow::Error> {
     fetchers.add(GhCrateMeta::new(&fetcher_data).await);
     fetchers.add(QuickInstall::new(&fetcher_data).await);
 
-    match fetchers.first_available().await {
+    if opts.no_third_party_sources {
+        info!("Installs from third party sources has been disabled");
+    }
+
+    match fetchers.first_available(!opts.no_third_party_sources).await {
         Some(fetcher) => {
             install_from_package(
                 binaries,
@@ -175,7 +187,16 @@ async fn main() -> Result<(), anyhow::Error> {
             )
             .await
         }
-        None => install_from_source(opts, package).await,
+        None => {
+            if opts.disable_cargo_install {
+                error!("Fallback to install from source is disabled via `--disable-cargo-install`");
+                Err(anyhow::anyhow!(
+                    "Installs from source is disabled via `--disable-cargo-install`"
+                ))
+            } else {
+                install_from_source(opts, package).await
+            }
+        }
     }
 }