[Pkg-rust-maintainers] Plan for updating (hypothetical future) firefox-esr versions in stable with changed build-deps?
infinity0 at debian.org
Fri Aug 26 10:53:00 UTC 2016
> On Fri, Aug 26, 2016 at 06:59:20 +0000, Angus Lees wrote:
>> Dear SRMs,
>> My understanding is that Debian's new-ish plan is to update firefox-esr
>> versions in stable when there is a security update and the firefox-esr
>> upstream support window for the previous version has expired.
>> What is the plan for handling any new build-deps this new firefox-esr
>> release might require, and how will they also be merged into the existing
>> stable release?
> I would expect firefox to bundle rustc, if needed, rather than relying
> on an external not-in-stable package. But I'm just a bystander, and the
> actual plan is in the hands of the firefox maintainer(s) and security
> team, not the release team.
(shall I drop debian-release@ off this thread?)
If Firefox bundles rustc, it would also have to bundle llvm. This is quite a lot of code to be bundling, almost doubling the source size. It would also increase its build time 4.5x, from ~1 hour to 4.5 hours (on a fast buildd machine ; my own machine is about 2x as slow).
rustc and llvm-3.8 will be in the next Debian stable, which is quite soon. And if I understood correctly, the future Firefox-with-rust build will use stable releases of rustc. These are released every 6 weeks, roughly on the same schedule as firefox-esr updates. The LLVM requirements stay the same across multiple releases.
I think it would be not much effort to keep backporting rustc to Debian stable to keep up with firefox-esr. rustc does not have other strictly-versioned dependencies apart from LLVM, so the backporting work would be minimal.
(cargo is harder, but it's also much smaller and quicker to build, so I think it's less of a problem to bundle that. Also right now Firefox-with-rust would be using cargo nightly; I don't know yet if they have plans to change this.)
More information about the Pkg-rust-maintainers