Bug#1017892: Ships copies of libraries that are in Debian and autogenerated files that can't be renegerated with the code in Debian main

[Sebastian Dröge]

Source: librsvg
Version: 2.54.4+dfsg-1
Severity: serious
Tags: upstream

Hi,

See the discussion on the Debian Rust maintainers list for background:
https://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/2022-August/022857.html

For more details how to solve this in a way that makes ftp-masters happy,
please refer to them.


The vendor subdirectory in the librsvg source package contains copies of
various Rust libraries in specific versions. Some of them are packaged in
Debian (i.e. the version from Debian should be used), others contain
autogenerated files for which the original source is not in Debian.

Examples for this are

  - vendor/semver corresponds to the rust-semver package in Debian. Here
    version 1.0.10 is included while Debian currently only has version 1.0.4.
    Both versions should be API compatible so that's not necessarily a
    problem for switching to the Debian version.

  - vendor/memchr corresponds to the rust-memchr package in Debian. Currently
    these two have the same version.

  - vendor/png corresponds to the rust-png package in Debian. Here version
    0.17.5 is included while Debian currently only has version 0.16.8. Both
    versions are not API compatible.

  - vendor/glib-sys corresponds to the rust-glib-sys package in Debian. Here
    version 0.15.10 is included while Debian currently only has version
    0.14.0. Both versions are not API compatible at all.

    In addition the src/lib.rs in that subdirectory has exactly the same
    problem mentioned in the above discussion. It is autogenerated from
    GLib-2.0.gir by the gir tool, and GLib-2.0.gir is autogenerated from the
    GLib (glib2.0 source package) source code.

    Either the original source in the exact version used here and everything
    to generate the files has to be shipped with the source package, or the
    files have to be regenerated at build time with whatever is available in
    Debian.

    See the above discussion for more details.


These are not all files affected. You'll have to check the whole content of
the vendor subdirectory on every release and ideally make sure each of these
are packaged in Debian in the correct version.

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (700, 'unstable'), (500, 'unstable-debug'), (100, 'experimental'), (1, 'experimental-debug')
merged-usr: no
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.18.0-4-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled