[Pkg-rust-maintainers] Plan for updating (hypothetical future) firefox-esr versions in stable with changed build-deps?

[Ximin Luo]

+pkg-mozilla-maintainers

Julien Cristau:
> On Fri, Aug 26, 2016 at 06:59:20 +0000, Angus Lees wrote:
> 
>> Dear SRMs,
>>
>> My understanding is that Debian's new-ish plan is to update firefox-esr
>> versions in stable when there is a security update and the firefox-esr
>> upstream support window for the previous version has expired.
>> What is the plan for handling any new build-deps this new firefox-esr
>> release might require, and how will they also be merged into the existing
>> stable release?
>>
> I would expect firefox to bundle rustc, if needed, rather than relying
> on an external not-in-stable package.  But I'm just a bystander, and the
> actual plan is in the hands of the firefox maintainer(s) and security
> team, not the release team.
> 

(shall I drop debian-release@ off this thread?)

If Firefox bundles rustc, it would also have to bundle llvm. This is quite a lot of code to be bundling, almost doubling the source size. It would also increase its build time 4.5x, from ~1 hour to 4.5 hours (on a fast buildd machine [1][2][3][4]; my own machine is about 2x as slow).

rustc and llvm-3.8 will be in the next Debian stable, which is quite soon. And if I understood correctly, the future Firefox-with-rust build will use stable releases of rustc. These are released every 6 weeks, roughly on the same schedule as firefox-esr updates. The LLVM requirements stay the same across multiple releases.

I think it would be not much effort to keep backporting rustc to Debian stable to keep up with firefox-esr. rustc does not have other strictly-versioned dependencies apart from LLVM, so the backporting work would be minimal.

(cargo is harder, but it's also much smaller and quicker to build, so I think it's less of a problem to bundle that. Also right now Firefox-with-rust would be using cargo nightly; I don't know yet if they have plans to change this.)

X

[1] https://buildd.debian.org/status/fetch.php?pkg=firefox&arch=arm64&ver=48.0-1&stamp=1470231782
[2] https://buildd.debian.org/status/fetch.php?pkg=rustc&arch=arm64&ver=1.10.0%2Bdfsg1-3&stamp=1469947147
[3] https://buildd.debian.org/status/fetch.php?pkg=llvm-toolchain-3.8&arch=arm64&ver=1%3A3.8.1-9&stamp=1471437328

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git