[Pkg-rust-maintainers] Facilitating Firefox+Rust Linux distro packaging

[Sylvestre Ledru]

Le 23/11/2016 à 19:22, Florian Weimer a écrit :
> * Sylvestre Ledru:
> 
>>> The main solutions as I recall them were:
>>>
>>> 1) Vendor evering with Firefox, rustc, Cargo, crates, llvm and clang. Really
>>>   straightforward but distasteful to distros generally.
>>> 2) Upgrade Rust while continuing to use the same LLVM. This solution
>>> is hard to
>>>   count on because the work to keep Rust compatible with the older LLVM may be
>>>   great. It's also unlikely that rust-bindgen will be compatible with whatever
>>>   clang happens to be available.
>>> 3) Create new rust, LLVM, and clang packages mid-release, just for
>>> the purposes
>>>   of supporting the Firefox ESR upgrade.
>>> 4) Switch _off_ Firefox ESR's and establish an upgrade schedule, that matches
>>>   Firefox's / Rust's, as policy exceptions. Similar to how chromium
>>> as managed,
>>>   but the scale of software Firefox is upgrading is even larger (two
>>> compilers).
>>>
>>> So I'm not coming with any new solutions. Just want to check
>>> in. Sylvestre, Gus,
>>> Mike, anybody else, is there any new information? Is the way forward
>>> any clearer
>>> now? How can we make it clear?
> 
>> This is an excellent summary. As packager of Rust and LLVM/clang,
>> the option 3) sounds reasonable if we can get an approval of the
>> Debian release management and security teams.
> 
> I'm worried that this sets a precedent for forcing MFTLs into stable
> releases, and ongoing updates of them.  Another concern is that cargo
> isn't even going to make it into stretch, so why it would qualify for
> jessie is beyond me.
> 
> Option 1 is really distasteful because we have to bootstrap Rust with
> pre-built binaries bundled with the sources.  Ocaml does the same
> thing, so it should be fine policy-wise, but it's still not what we
> generally strive for.  That's also a problem for option 4 (but I don't
> quite understand that one, it seems to be orthotogonal to the rest).
> 
> Option 2 is just a choice of how to build Rust.  The only feasible way
> seems to be to use the bundled LLVM from upstream, considering that
> other things in the distribution might prevent us from upgrading LLVM
> as required by future Rust versions.
We could do that even if this is not the "Debian way".


> Thinking out of the box, could Mozilla provide an apt-gettable archive
> for jessie and stretch which contains the official builds?  Then we
> could stop shipping Firefox.  This is what we ordinarily would do when
> faced with such challenges.
Maybe but this means that stable users would remain on an old version without
security updates if they don't update their source list.


> To be clear, I don't have anything against Rust at all.  I'm playing
> with it right now, and it definitely shows great promise.  But the way
> Firefox's upstream choices force hour hands seems highly irregular.
I think you misunderstood the situation. Mozilla is not forcing the hand of anyone
here. Mozilla made the choice to use strongly Rust for future development.
Rust is moving fast. Debian is not.
Now, we (Mozilla and Debian) are discussing our options to accommodate objectives of both projects.

Sylvestre