avoid curl | sh
In the deps script rustup is installed using a remote curl piped to sh. This can be dangerous if the target domain get compromised for any reason (see what happened with codecov).
A more static installation procedure should be used.