Too slow in mainland China

[LEXUGE]

rustup update is very slow and prone to failure in mainland China .
I'm persecuted by this issue.
And many rustaceans in China have this problem too.
So, how to solve it?

PS: we now have mirror of rustup in China, but we can't avoid middleman.
So if rustup can provide GPG signature mechanism like debian and other linux distro do. It can solve the issue in another way maybe.

[nodakai]

Basically most (if not all) files under https://static.rust-lang.org/dist/ come with SHA256 checksums as well as GPG signatures by the Rust team:

$ curl https://static.rust-lang.org/dist/channel-rust-stable.toml
manifest-version = "2"
date = "2018-07-20"
[pkg.cargo]
version = "0.28.0 (1e95190e5 2018-05-27)"
[pkg.cargo.target.aarch64-unknown-linux-gnu]
available = true
url = "https://static.rust-lang.org/dist/2018-07-20/cargo-0.28.0-aarch64-unknown-linux-gnu.tar.gz"
hash = "c8df753a61c2951267c4bec214442905827b09a0d05ce755144a8249a675f971"
xz_url = "https://static.rust-lang.org/dist/2018-07-20/cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz"
xz_hash = "506d4b31c637a89a51c8aac6ae2b12655f7faa73425906c2cc6d8cf118658cc8"
...snip...

$ wget -q https://static.rust-lang.org/dist/2018-07-20/cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz
$ sha256sum cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz 
506d4b31c637a89a51c8aac6ae2b12655f7faa73425906c2cc6d8cf118658cc8  cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz

$ curl https://static.rust-lang.org/dist/channel-rust-stable.toml.sha256
4e2c0af18a83631cff9f35e4954963c1ab8a1c26de76fee2b6c21d2bcf1a6de2  channel-rust-stable.toml
$ sha256sum channel-rust-stable.toml
4e2c0af18a83631cff9f35e4954963c1ab8a1c26de76fee2b6c21d2bcf1a6de2  channel-rust-stable.toml

You can find the official GPG signing key here:

$ curl -s https://static.rust-lang.org/rust-key.gpg.ascii | LANG=C gpg --import
gpg: key 85AB96E6FA1BE5FE: "Rust Language (Tag and Release Signing Key) <rust-key@rust-lang.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

$ wget -q https://static.rust-lang.org/dist/channel-rust-stable.toml.asc
$ LANG=C gpg --verify channel-rust-stable.toml{.asc,}
gpg: Signature made Fri Jul 20 23:40:20 2018 +08
gpg:                using RSA key 5CB4A9347B3B09DC
gpg: Good signature from "Rust Language (Tag and Release Signing Key) <rust-key@rust-lang.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 108F 6620 5EAE B0AA A8DD  5E1C 85AB 96E6 FA1B E5FE
     Subkey fingerprint: C134 66B7 E169 A085 1886  3216 5CB4 A934 7B3B 09DC

$ wget -q https://static.rust-lang.org/dist/2018-07-20/cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz.asc
$ LANG=C gpg --verify cargo-0.28.0-aarch64-unknown-linux-gnu.tar.xz{.asc,}
gpg: Signature made Fri Jul 20 23:39:42 2018 +08
gpg:                using RSA key 5CB4A9347B3B09DC
gpg: Good signature from "Rust Language (Tag and Release Signing Key) <rust-key@rust-lang.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 108F 6620 5EAE B0AA A8DD  5E1C 85AB 96E6 FA1B E5FE
     Subkey fingerprint: C134 66B7 E169 A085 1886  3216 5CB4 A934 7B3B 09DC

Note the Good signature part, though GPG is doubting the authenticity of the imported key...

Users should be able to set RUSTUP_DIST_SERVER to point rustup to your mirror:

• https://github.com/rust-lang-nursery/rustup.rs#environment-variables

[LEXUGE]

So, it is solved.
Thank you