[Pkg-rust-maintainers] Bug#1152310: cargo: allows unstable features while reporting stable version

[Crystal Durham]

Source: rustc
Severity: normal
X-Debbugs-Cc: crystal.durham at canonical.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


d-0012-cargo-always-return-dev-channel.patch makes it so cargo::core::features
returns "dev", which tells Cargo to allow unstable features. This is relied
upon by the cargo wrapper, which sets -Zavoid-dev-deps.

Unfortunately, this means that if a user runs /usr/bin/cargo, they see stable
Cargo, but are able to enable unstable features of Cargo without any warning.

This pattern has been discussed upstream at: https://rust-lang.zulipchat.com/#narrow/channel/606878-rust-packaging/topic/use.20of.20unstable.20features.2Fbuilds.20in.20distro.20packaging/with/635157713

Since Debian only needs unstable features for the cargo wrapper, ideally we
should only enable the use of unstable features when using the cargo wrapper
and not for general usage of /usr/bin/cargo.

A reasonable fix should be straightforward: replace the existing patch with
one that checks an environment variable set by the cargo wrapper just like
$RUSTC_BOOTSTRAP is checked (only for Cargo). For example:

                  return "dev".to_string();
              }
          }
    --    crate::version()
    --        .release_channel
    --        .unwrap_or_else(|| String::from("dev"))
    -+    // Debian: always return dev channel
    -+    String::from("dev") }
    ++    // Debian: return dev channel when DEB_CARGO_ALLOW_UNSTABLE is set
    ++    #[expect(
    ++        clippy::disallowed_methods,
    ++        reason = "debian patch, no reason for config support"
    ++    )]
    ++    if let Ok(staging) = env::var("DEB_CARGO_ALLOW_UNSTABLE") {
    ++        if staging == "1" {
    ++            return "dev".to_string();
    ++        }
    ++    }
    +     crate::version()
    +         .release_channel
    +         .unwrap_or_else(|| String::from("dev"))
      }
 
      /// Only for testing and developing. See ["Running with gitoxide as default git backend in tests"][1].

This should align Debian's Cargo more closely with upstream without disrupting
packaging work.

- -- System Information:
Debian Release: forky/sid
  APT prefers resolute-updates
  APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.0-38-generic (SMP w/24 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

- -- no debconf information

-----BEGIN PGP SIGNATURE-----

iQJRBAEBCgA7FiEEhZNsKDIyCbvKZ3yUxDIOCvYBpesFAmrg/lYdHGNyeXN0YWwu
ZHVyaGFtQGNhbm9uaWNhbC5jb20ACgkQxDIOCvYBpesQ0BAAli+6ti03phGFnXRT
bbSJKqPr8rTSnNae3MR/5OiSpid/JMq5xNSjw4s0lz6qibSr3QM1EwzPbbef7pyB
50C9F1uZcIAd6Aj5bCpJISJ0FqXpD755mScCPSAkuqdF9SIN1DVnvb5Enn7fQPgc
AW63XlwTs7D2NsecQWwpT3uYQBAxVNUTNwfqHWefZAqPISWO82vvmeRRLzKGf8HN
tfOi9N01Zz8FOd/rLuWezhXCRDYVfENwHizZjVo+bkKC4f3rcrcZKJw8D+WUY0OD
8+6wZNVA+hM4ZuaNGCkfn+UGZ76H2QWeCG5AQXoz5lll0H94VWTL3thfG7lmuXD7
Dvpr3xBrxmO0jYoeeOs0BrfvN8n2M+UPXn3hxRurdix1J8rZK2hU1nkaBy++N4rV
fmNppVjnFtI143zfrU7OFR+blNxqCSqrCdaWYdgM8AZUdaDvsF4O8q50YlKk8EGi
h29eZ8w0allRn+G8EQD04K0o/EHrDQmfvlRSoYYDR/brLqWQSxpRUEe06nrdx522
rijnlUgjyl2ZehOUq7BRW0NzTKfB0VoUzjyeP4IcuiFa3hB8vtrFl9GOGFSoImPf
RILISV4DPuG6F7wqcNRxjQigRwDJkvtyxVx6Kf6FIGaQJmD5O1yUE8xPF3NW6pXq
PDJU+nvkHEQSDKuq1wJG+z9rXj0=
=Hb0d
-----END PGP SIGNATURE-----