[Pkg-rust-maintainers] Facilitating Firefox+Rust Linux distro packaging

[Florian Weimer]

* Sylvestre Ledru:

>> The main solutions as I recall them were:
>> 
>> 1) Vendor evering with Firefox, rustc, Cargo, crates, llvm and clang. Really
>>   straightforward but distasteful to distros generally.
>> 2) Upgrade Rust while continuing to use the same LLVM. This solution
>> is hard to
>>   count on because the work to keep Rust compatible with the older LLVM may be
>>   great. It's also unlikely that rust-bindgen will be compatible with whatever
>>   clang happens to be available.
>> 3) Create new rust, LLVM, and clang packages mid-release, just for
>> the purposes
>>   of supporting the Firefox ESR upgrade.
>> 4) Switch _off_ Firefox ESR's and establish an upgrade schedule, that matches
>>   Firefox's / Rust's, as policy exceptions. Similar to how chromium
>> as managed,
>>   but the scale of software Firefox is upgrading is even larger (two
>> compilers).
>> 
>> So I'm not coming with any new solutions. Just want to check
>> in. Sylvestre, Gus,
>> Mike, anybody else, is there any new information? Is the way forward
>> any clearer
>> now? How can we make it clear?

> This is an excellent summary. As packager of Rust and LLVM/clang,
> the option 3) sounds reasonable if we can get an approval of the
> Debian release management and security teams.

I'm worried that this sets a precedent for forcing MFTLs into stable
releases, and ongoing updates of them.  Another concern is that cargo
isn't even going to make it into stretch, so why it would qualify for
jessie is beyond me.

Option 1 is really distasteful because we have to bootstrap Rust with
pre-built binaries bundled with the sources.  Ocaml does the same
thing, so it should be fine policy-wise, but it's still not what we
generally strive for.  That's also a problem for option 4 (but I don't
quite understand that one, it seems to be orthotogonal to the rest).

Option 2 is just a choice of how to build Rust.  The only feasible way
seems to be to use the bundled LLVM from upstream, considering that
other things in the distribution might prevent us from upgrading LLVM
as required by future Rust versions.

Thinking out of the box, could Mozilla provide an apt-gettable archive
for jessie and stretch which contains the official builds?  Then we
could stop shipping Firefox.  This is what we ordinarily would do when
faced with such challenges.

To be clear, I don't have anything against Rust at all.  I'm playing
with it right now, and it definitely shows great promise.  But the way
Firefox's upstream choices force hour hands seems highly irregular.