[Pkg-rust-maintainers] rust ecosystem worries of a release team member

[Julien Cristau]

On Thu, Jan 09, 2020 at 01:38:53PM +0000, Ximin Luo wrote:
> Paul Gevers:
> > Hi all,
> > 
> > On 05-01-2020 14:39, Ximin Luo wrote:
> >> Paul Gevers:
> >>> [..]
> >>>
> >>> [1] Now thunderbird is blocked by rust-cbindgen (last version migrated
> >>> in September with uploads since October), which is blocked by rust-syn
> >>> (last version migrated in July, with new uploads since August). Involved
> >>> is rust-proc-macro2 (last version migrated in July, with new uploads
> >>> since August (and currently triggers an autopkgtest regression)),
> >>> rust-unicode-xid (which has been trying to migrate to testing since
> >>> August),  rust-quote (trying to migrate since August). And I may be
> >>> missing others. rustc was involved at some moment, cargo was involved
> >>> (and FTBFS for some time) etc...
> > 
> > And today another firefox-esr, with CVE fixes, appeared, which is also
> > blocked by this.
> > 
> 
> I just had a look, and both firefox-esr and thunderbird still are vendoring their own rust source code in third_part/rust/* and make no attempt to integrate with dh-cargo or our cargo-debian-wrapper in d/rules in the way that I prescribe here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907629#30
> 
> So their current build-dependencies on any librust-* packages are bogus, and can simply be dropped to progress with migration.
> 
> Likewise, rustc and cargo are purposefully designed to vendor their own crates, and *not* depend on any librust-* packages, and so they shouldn't affect migration either.
> 
firefox-esr doesn't build-depend on any librust-* package.  It
build-depends on rustc, cargo, and cbindgen.  But cbindgen is not in
testing, and *it* build-depends on a bunch of librust-*-dev packages,
which block its migration to testing.

Cheers,
Julien