Nicolas Graves schreef op di 15-03-2022 om 14:26 [+0100]:
> > Wouldn't this be a problem of the 'rust-rsa' package?  I would move
> > this version relaxing to the 'rust-rsa' package, such that all
> > dependents of rust-rsa can benefit.
> 
> I don't think that necessarily applies to every package dependent on
> rust-rsa, I would rather keep it this way.

Some remarks:

  * while cargo-build-system creates a "guix-vendor" directory,
    this seems an implementation detail to me, maybe one day it will
    switch to a {CROSS_,}LIBRARY_PATH system like gcc uses.

  * IIUC it does necessarily apply to every package dependent on
    rust-rsa, at least those using #:cargo-inputs
    / #:cargo-development-inputs.

    Empirically: I searched for "rust-rsa" in the source code of Guix.
    Its only user 'rbw' apparently copies the 'substitute*'.

    Theoretically: suppose a package rust-foo depends on rust-rsa (and
    for simplicity, assume that rust-rsa is its only dependency), via
    #:cargo-inputs / #:cargo-development-inputs.

    Then currently, rust-rsa builds because of its 'relax-requirements'
    phase, but IIUC, this is forgotten when 'rust-foo' is being built,
    because 'expand-crate-sources' in (guix build-system cargo) just
    looks at the 'source' field of 'rust-rsa' and not the build result,
    so the build of rust-foo would fail (unverified).

  * even if it's not necessary for all dependents, but only for, say,
    20%, it seems more convenient to me to only have to do the
    substitute* in a single location (i.e., rust-rsa).  An additional
    benefit is that, if the version requirements change at some point
    in the future, then the 'substitute*' only has to be adjusted in a
    single place.

Greetings,
Maxime.