[Pkg-rust-maintainers] Packaging software written in Rust

[Josh Triplett]

On Sun, Jul 17, 2016 at 08:57:40PM -0700, Josh Triplett wrote:
> I'll see if I can get a version of cargo with the directory registry
> patches to build some crates with only local sources.

I've managed to get this to work.

I built Cargo from the version in
https://github.com/rust-lang/cargo/pull/2857 (commit
dfdc1c4002e91aca15636cbd1badb319bd9f7ca7), and put that on my $PATH.

I checked
https://github.com/rust-lang/crates.io-index/blob/master/an/si/ansi_term
to find the latest version of ansi_term (0.8.0) and the checksum
(c877397e09fec7a240af5fa74ad0124054b8066149d6544cd1ace93f8de3be68).

I created a directory /tmp/debian-registry, downloaded
https://crates.io/api/v1/crates/ansi_term/0.8.0/download , confirmed
that it had the above sha256sum, and unpacked it in that directory; it
unpacked into a directory ansi_term-0.8.0 .

I created the file
/tmp/debian-registry/ansi_term-0.8.0/.cargo-checksum.json , containing
the following line:

{"package":"c877397e09fec7a240af5fa74ad0124054b8066149d6544cd1ace93f8de3be68","files":{}}

(Turns out that Cargo only verifies checksums for files listed in
"files", but doesn't do anything to check files not listed.)

I then created a new crate "deptest" with "cargo new --bin deptest".  In
deptest's Cargo.toml, in the [dependencies] section, I added:

ansi_term = "*"

Inside the deptest directory, I created a .cargo/config file,
containing:

[source.crates-io]
replace-with = 'debian-registry'
local-registry = "/nonexistent"

[source.debian-registry]
directory = '/tmp/debian-registry'

(Cargo requires [source.crates-io] to include either registry or
local-registry, hence the /nonexistent; Alex Crichton suggested that
that was a bug.)

I then ran "cargo build" in deptest, which got the source from the
debian-registry and built without downloading anything.

Once we have a version of Cargo with that pull request included, and we
have a way to specify the above source replace-with configuration via
either an environment variable or the Cargo command line, I think we
have all the pieces necessary to package Rust libraries and binaries
manually.

The remaining bits we might want (but don't have to have all at once
before we start packaging):

- A common package to build-depend on that includes the script to invoke
  Cargo with the right parameters and/or environment variables.

- A script to download a .crate file from crates.io (either the most
  recent version or a specified version), with checksum verification.
  Probably easiest to do this as a cargo subcommand.

- A script to generate a debian/ directory for a library crate.  This
  should generate debian/control (with the version number, Description,
  and Depends for all the cargo dependencies), debian/copyright (based
  on the license and license-file keys in Cargo.toml), debian/rules
  (minimized dh version), etc.

- A script to generate a debian/ directory for a binary crate.  This
  will share a bit with the above (version, Description), but needs to
  put the dependencies in Build-Depends and emit a completely different
  debian/rules.

- A Debian Rust Packaging Policy, defining the approach, the
  installation directories, the translation from crate name to package
  name (librust-cratename-dev with s/_/-/ in crate name), etc.