From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 0DgKOKl4sGF5IQEAgWs5BA (envelope-from ) for ; Wed, 08 Dec 2021 10:19:37 +0100 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id eACVM6l4sGGEWAAAbx9fmQ (envelope-from ) for ; Wed, 08 Dec 2021 09:19:37 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id A7AA030041 for ; Wed, 8 Dec 2021 10:19:37 +0100 (CET) Received: from localhost ([::1]:49348 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mut6u-0008HM-PP for larch@yhetil.org; Wed, 08 Dec 2021 04:19:36 -0500 Received: from eggs.gnu.org ([209.51.188.92]:44876) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mut6h-0008Gu-QZ for guix-devel@gnu.org; Wed, 08 Dec 2021 04:19:23 -0500 Received: from flashner.co.il ([178.62.234.194]:36890) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mut6g-0003Es-C9; Wed, 08 Dec 2021 04:19:23 -0500 Received: from localhost (unknown [94.230.83.253]) by flashner.co.il (Postfix) with ESMTPSA id 96B5E40190; Wed, 8 Dec 2021 09:19:20 +0000 (UTC) Date: Wed, 8 Dec 2021 11:16:13 +0200 From: Efraim Flashner To: guix-devel@gnu.org Subject: [CORE-UPDATES] librsvg and rust Message-ID: Mail-Followup-To: guix-devel@gnu.org, Liliana Marie Prikler , Ludovic =?utf-8?Q?Court=C3=A8s?= MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NTK8h1J1I53IKg26" Content-Disposition: inline X-PGP-Key-ID: 0x41AAE7DCCA3D8351 X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc X-PGP-Fingerprint: A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Received-SPF: pass client-ip=178.62.234.194; envelope-from=efraim@flashner.co.il; helo=flashner.co.il X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Liliana Marie Prikler Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1638955177; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:list-id:list-help:list-unsubscribe: list-subscribe:list-post; bh=ZwOQI3brhBphiVKxf8Hh8N/tAxdE59EkP+7s/cIy6bI=; b=rjz5MPbnTXkHtI8FN2kN913FQjZfwN6xxUXvGsYb0dZPfSmzbWP/2f4xUpMgoZ5Q6mq8wB w4OlClNwwOGWEBqCbz7PjrRbgAHKDODkeDhdpwvm79Igo3CpYssoMrhRRSlIy3qfhyYmjJ HmQdC0LCoUDgY2EnmvnQbuf2gnfnfzuBr4VCWZhO7IN/tT3ImjUFOrfXPngMGfzZCnmaGa yuYNbfXi+VUl/tULJcmZb/O4lZVO03s/hKqkt84Dft7junAG4qe4WZm5lefVJE7Fp1pHUE IlUpbx8l3aKKRWf1uH69ZKw1SZ8m7CQW6sEuauwwuyzRQ4i2D5oqTYdOuCBY1g== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1638955177; a=rsa-sha256; cv=none; b=pudKojqJDSl2fcqfqNCRoRKLFl/L8jw5qy4EhOEtFD7GRVKbebq69J2aZWwFU5q024XQK8 zz4DrIVxor9+seyBs5twq8DVlgeZunkJtTMTw7P/bvYKCtpkcl0y5kE+YG7aNBhPb3WB85 H5loAASIzj0BI/Kk0xwrqjFUUz/cRL7Us1VmJw82Igv3d3zxEy22u6LgrFBflbIuzf9sl5 qjCruvZjXhTcsgIHPra3ro9VCZNvOCJIkZrSHjzMvtC4gGo4t/Mf8MJxzipOhSyujbZiUe UIwATBkZ2QjRZrw/K5QY/dsreLovQZ1+ZLEw2a0xnkKmpwnWB8XBou8+0aHFVA== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -4.55 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: A7AA030041 X-Spam-Score: -4.55 X-Migadu-Scanner: scn1.migadu.com X-TUID: VWdgP47qYTYP --NTK8h1J1I53IKg26 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Core-updates is almost done which means we need to come to a decision about librsvg and the rust crates. The problem: The librsvg tarball includes bundled rust crates. We normally unbundle bundled sources, and we just so happen to have a) replacement crates for the bundled ones, b) a method to replace them, and c) a method to build the package with our packaged crates. There are multiple cycles between the crates themselves, and between "traditional" packages (like gtk) and librsvg, traversing the crates. We (currently) cannot track the dependency cycles between the crates, so we need to Do Something=E2=84=A2. Option 1: Track down the ~220 crates which form the dependency graph (of crates) for librsvg and pin them until the next core-updates cycle. Continue like with other packages and add newer versions (like cmake or meson) as packages need them.=C2=B9 Option 2: Use the bundled crates and treat it as just part of the librsvg source code.=C2=B2 Option 2b: Use the bundled crates for now to finish with core-updates-frozen and revisit this immediately on core-updates (not frozen). Notes: Bug 51845 is so far where it's been discussed a bit, but it seems more relevant for guix-devel. Ludo has made a nice first patch at treating rust packages in inputs as cargo-inputs (and native-inputs as cargo-development-inputs), allowing us to piecemeal change the rust crates. This doesn't directly help with our librsvg problem, but will help us track dependencies across rust packages. Thoughts? I'm currently leaning option 2b, it'll get us past this hurdle for core-updates-frozen and let us make changes to the crates as we work to integrate them more fully into Guix. =C2=B9 If there are any security problems in any of the crates we'd be grafting librsvg itself, not the individual crates (this is due to how crates are used). =C2=B2 (We are not Debian) This is what Debian does. --=20 Efraim Flashner =D7=A8=D7=A0=D7=A9=D7=9C=D7=A4 = =D7=9D=D7=99=D7=A8=D7=A4=D7=90 GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted --NTK8h1J1I53IKg26 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAmGwd9sACgkQQarn3Mo9 g1HRXxAAwwnwAhgh8DxvMH4DCap2qfrOQ8MKRn9pnTaHlThgfM8lgunc3VoyJFzF 8CQ9nf3ggJyGF4FU/kflR5nQ8Y0a72RzekxjcFKuDZ1O2Ex8+0YxFe1fbCzD/V2r kU7mIE8zUJHUD16RzuLkJv+xXbTHteK0C/faVhwLqRmi18D9/ZVFLgCzUrktijEF 6rhbN1f+AkqY/PCnnQblvjYbrQHM3FQ7ZqNzDQxFe64ZV9nZoHn680TRop3Zn2ma 98KsbvKZLQDgmkoFbnWFqP0Lqhg1t7pr3s44iLg1xfn7RQ1/PynPjpU0yv6nvLeX jMDjVN1dIkFJMMtdpGT7BCuQ6w1f6Jh9SZS6zozPYE9bMeAeJJKDfZOj5xOiKfOZ LF4ytFs0eYwOWPx+dYizy7HhSMbZcAFyekSgN8BmqXFYWHKjFSq0BsEBNlh554gK WA5LKnrH6V6IwmA5y3KLf3uXNpCCBzu1mMBQiex4ZWZ5gDHG+Y3zNc0Q30MGOEEF 9QkkEs/pHbXrbO+qXxbqnDsuQ2Ya5B4T0Yx+eZfcC6RqUsinkjWZsnK6UdrVPjmJ F9Z+pufPvcVXXvwbABnK1kygAQAWGFyYb6J+xkktQyBuOU6mIPJUb2732f/R+mUS Y7gFd3WipfN8Zw3iVHCWPoqOSFbKeU5GVWuZq1oiuor+/k0V/tw= =NhKW -----END PGP SIGNATURE----- --NTK8h1J1I53IKg26--