[Pkg-rust-maintainers] Status update on cargo packaging

[Luca Bruno]

Hi all,
as some of you may have read in IRC, cargo recently went through NEW and
today I updated it to 0.6.0. Below some details on the packaging.

> tldr: we now use a cargo-vendor approach to allow for offline builds.
        Deps are still embedded as they haven't reached a stable v1 interface.

Long story:

We currently embeds all dependencies (under deps/, with a dedicated tarball)
and we will keep for some time. All crates with v0 major version have no
guarantee at all of API stability, so it makes little sense to package them
all ATM (versioning hell). The plan (still to be discussed) is to start
introducing packaging as soon as they reach v1 major for API stability.
More on this in the next weeks.

In 0.3.0 I tried to use paths overrides. Angus also tried a very similar approach. 
As you can see from the git history and from angus comments[0], this is a bloodbath
and requires a lot of patching and custom fiddling.
Also, this requires to make somehow available a copy of crates.io registry.
[0] https://internals.rust-lang.org/t/perfecting-rust-packaging-the-plan/2767/26

For 0.6.0 instead, we decided to follow an approach similar to cargo-vendor[1].
Dependencies sources are still embedded under deps/, but now without any patching.
A fake registry index is assembled under vendor/, and .cargo/config is pointed there.
As such, cargo never tries to fetch remote assets, and just happily build with whatever
is provided locally.
This also means we don't need to ship any registry index, as we generate a minimal one
ourself.
[1] https://github.com/alexcrichton/cargo-vendor

I currently have a crude cargo-vendor-pack.py helper to assemble the fake registry,
but as I think this is the path forward, I plan to grow this into a full dh_cargo
(because any other project building with cargo can be done this way) and
also look for non-embedded dependencies (source-include-paths still to be formalized). 

The remaining tricky parts of cargo is that it still needs to somehow boostrap a stage0
(we use cargo-bootstrap[2] for this) and that you have to assemble a large tarball
of dependencies (48 at the moment, I use cargo-vendor to fetch them).
[2] https://github.com/dhuseby/cargo-bootstrap/

Ciao, Luca

-- 
 .''`.  ** Debian GNU/Linux **  | Luca Bruno (kaeso)
: :'  :   The Universal O.S.    | lucab (AT) debian.org
`. `'`                          | GPG: 0xBB1A3A854F3BBEBF
  `-     http://www.debian.org 	| Debian GNU/Linux Developer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.alioth.debian.org/pipermail/pkg-rust-maintainers/attachments/20151204/a604bd0a/attachment.sig>