[Pkg-rust-maintainers] Bug#1009888: Bug#1009888: rust-h2, existing version is badly broken, new upstream needs new package

[Fabian Grünbichler]

On April 20, 2022 12:33 am, Peter Michael Green wrote:
> Package: rust-h2
> Version: 0.1.26-1
> X-debbugs-cc: dr at jones.dk
> 
> I noticed that Jonas had set a number of bugs about broken rust packages as
> blockers of 900928, so I decided to take a look at some of them. I fixed up
> bytemuck, image and related packages.
> 
> I then started looking at reqwest which lead me to h2 (which has been broken
> since the tokio 1.x transition but noone ever got around to filing a 
> bug) which
> lead me to http which jonas recently NMU'd.
> 
> I feel I need to comment on the technical details of the NMU, I should 
> preface
> this by saying that I don't think it's unreasonable to 0-day NMU a minimal
> fix for a long term RC issue, even if (as was not the case here but was the
> case for some of the other NMUs noone ever bothered to actually file the
> RC bug).
> 
> However, this NMU did considerably more than just add a minimal fix for
> the rc issue. Most painfullly, the "orig" tarball for the new upstream 
> version
> appears to have been derived from upstream git rather than from crates.io
> and this breaks our workflow. If you are going to 0-day stuff please keep
> your uploads minimal. If you want to do more invasive NMUs please give
> the maintainers a chance to respond.
> 
> Fortunately it seems the answer is to move to an even newer upstream
> version. The only reverse dependencies of rust-http seem to be the
> h2/hyper stack which badly needs an update to move away from tokio
> 0.x. I have already committed the http update to debcargo-conf and may
> upload it at some point.
> 
> Unfortunately moving back up the stack I ran into another issue. h2 and
> hyper have grown a new dependency on tracing. While I am I am happy to
> help with fixing existing rust packages, I am reluctant to take 
> responsibility
> for a new package unless it's something I personally use.
> 
> So this is where I personally tap out on h2/hyper until/unless someone
> packages tracing.

we use this stack (h2/hyper) downstream, I can take care of it over the 
coming weeks. tracing is unfortunately still rather in-flux, so it will 
likely see frequent upgrades.