[bug#32834] [PATCH] gnu: icecat: Build with rust-1.24.

[ludo@gnu.org (Ludovic Courtès)]

Mark H Weaver <mhw@netris.org> skribis:

> Danny Milosavljevic <dannym@scratchpost.org> writes:
>
>> On Sat, 29 Sep 2018 23:55:36 +0200
>> ludo@gnu.org (Ludovic Courtès) wrote:
>>
>>> Hi Efraim,
>>> 
>>> Efraim Flashner <efraim@flashner.co.il> skribis:
>>> 
>>> > * gnu/packages/gnuzilla.scm (icecat)[native-inputs]: Use the oldest
>>> > compatable rust over newer releases when building icecat.  
>>> 
>>> [...]
>>> 
>>> > +      ;; Icecat 60 checkes for rust>=1.24
>>> > +     `(("rust" ,rust-1.24)
>>> > +       ("cargo" ,rust-1.24 "cargo")  
>>> 
>>> I suppose the goal is to reduce the build chain, right?
>>> 
>>> Mark, Danny: WDYT?
>>
>> I think it's a good idea.
>>
>> Eventually, the rust bootchain will change to mrustc -> rust@1.25.0 -> ...,
>> but we can cross that bridge when we come to it.
>>
>> I'm not sure about Rust's policy with regard to CVEs.  Are those patched
>> in old releases, too?
>
> Indeed, that's my main concern.  Might the older Rust compilers have
> bugs that could lead to security flaws in IceCat?

I suppose vulnerabilities are more likely to be present in Rust’s
standard library than in the compiler, but the problem remains.  Given
the fast development pace, I’d be surprised if past releases received
security fixes.

> Here's another possible approach to mitigate the cost of building this
> long chain of Rust compilers: perhaps older versions of Rust could use
> only minimal and highly stable inputs, such that they would be built
> only once per core-updates cycle.  Thoughts?

If it’s possible, that’d be great.

Thanks,
Ludo’.