feat: flags to disable third-party and from source installs

src/bins.rs

@@ -47,7 +47,9 @@ impl BinFile {
         let dest = data.install_path.join(dest_file_path);
 
         // Link at install dir + base-name{.extension}
-        let link = data.install_path.join(&ctx.render("{ bin }{ binary-ext }")?);
+        let link = data
+            .install_path
+            .join(&ctx.render("{ bin }{ binary-ext }")?);
 
         Ok(Self {
             base_name,

src/fetchers.rs

@@ -52,17 +52,19 @@ impl MultiFetcher {
         self.fetchers.push(fetcher);
     }
 
-    pub async fn first_available(&self) -> Option<&dyn Fetcher> {
+    pub async fn first_available(&self, allow_third_party_sources: bool) -> Option<&dyn Fetcher> {
         for fetcher in &self.fetchers {
-            if fetcher.check().await.unwrap_or_else(|err| {
-                debug!(
-                    "Error while checking fetcher {}: {}",
-                    fetcher.source_name(),
-                    err
-                );
-                false
-            }) {
-                return Some(&**fetcher);
+            if allow_third_party_sources || !fetcher.is_third_party() {
+                if fetcher.check().await.unwrap_or_else(|err| {
+                    debug!(
+                        "Error while checking fetcher {}: {}",
+                        fetcher.source_name(),
+                        err
+                    );
+                    false
+                }) {
+                    return Some(&**fetcher);
+                }
             }
         }
 

src/main.rs

@@ -50,6 +50,14 @@ struct Options {
     #[structopt(long)]
     no_cleanup: bool,
 
+    /// Do not allow installs from third party sources such as quickinstall
+    #[structopt(long)]
+    no_third_party_sources: bool,
+
+    /// Disable fallback installation via `cargo install`
+    #[structopt(long)]
+    disable_cargo_install: bool,
+
     /// Override manifest source.
     /// This skips searching crates.io for a manifest and uses
     /// the specified path directly, useful for debugging and
@@ -161,7 +169,11 @@ async fn main() -> Result<(), anyhow::Error> {
     fetchers.add(GhCrateMeta::new(&fetcher_data).await);
     fetchers.add(QuickInstall::new(&fetcher_data).await);
 
-    match fetchers.first_available().await {
+    if opts.no_third_party_sources {
+        info!("Installs from third party sources has been disabled");
+    }
+
+    match fetchers.first_available(!opts.no_third_party_sources).await {
         Some(fetcher) => {
             install_from_package(
                 binaries,
@@ -175,7 +187,16 @@ async fn main() -> Result<(), anyhow::Error> {
             )
             .await
         }
-        None => install_from_source(opts, package).await,
+        None => {
+            if opts.disable_cargo_install {
+                error!("Fallback to install from source is disabled via `--disable-cargo-install`");
+                Err(anyhow::anyhow!(
+                    "Installs from source is disabled via `--disable-cargo-install`"
+                ))
+            } else {
+                install_from_source(opts, package).await
+            }
+        }
     }
 }