[Pkg-rust-maintainers] Progress on debian packaging for the Sequoia OpenPGP library

[Daniel Kahn Gillmor]

I'm trying to get sequoia installable "the debian way", using
debcargo-conf to get all of the relevant rust modules (depenencies)
packaged up appropriately.

I made some decent progress today, but it's still not done.  This is a
status report.

You can see my work on the WIP-sequoia branch on
https://salsa.debian.org/dkg/debcargo-conf.git

Many thanks to kpcyrd, who helped me understand more about debian
packaging of rust crates over on #debian-rust.

Insights
--------

The biggest insight I got from kpcyrd is that debian packaging is based
on the packages published in crates.io, so the upstream git repository
layouts are basically irrelevant to debian's perspective; so, i can
package the simpler crates that have been split out from the sequoia
source without too much trouble.  However, this also means that keeping
the parts up-to-date in debian will require as much work as there are
different packages split out -- a simple upgrade to sequoia 0.8.0 won't
bump all the associated packages.

Problems
--------

I ran into a problem with the debian packaging for string_cache_shared,
which i fixed with an NMU: https://bugs.debian.org/929337

The main remaining stumbling block that (i think) is keeping me from
building a significant piece of sequoia in debian at this point is that
sequoia uses an older version of lalrpop.  Debian rust packaging
practice is to try to add only the newest version of any given crates to
debian via debconf-cargo if possible.  lalrpop 0.17.0 was released
earlier this year, but sequoia-openpgp and sequoia-rfc2822 wants to use
lalrpop = 0.16.  Is this something sequoia could update to?

If not, i'll need to justify the attempted inclusion of the older
lalrpop.  Worse, lalrpop 0.16 uses an older version of term (0.4) than
what is already in debian, which would mean needing to pin that version
as well, and term 0.4 itself appears to depend on older versions of
kernel32-sys and winapi (why "winapi" is relevant for building on
debian, i can't imagine, but i'm just flailing here and reporting what i
see).

Anyway, the RELEASES.md file for lalrpop doesn't make 0.17.0 sound too
scary:

    https://github.com/lalrpop/lalrpop/blob/master/RELEASES.md

I've opened:

    https://gitlab.com/sequoia-pgp/sequoia/merge_requests/165

to request the update to lalrpop, but the automagically-configured
gitlab runner shows errors that i don't understand:

    https://gitlab.com/dkg/sequoia/-/jobs/216871331

Any help in resolving this would be most welcome, and might mean that we
get something like sequoia in debian experimental sooner rather than
later :)

Thanks for all the ongoing work on sequoia!  I hope this doesn't add to
your troubles.

        --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/attachments/20190521/504fbdf3/attachment.sig>