[Pkg-rust-maintainers] Facilitating Firefox+Rust Linux distro packaging

[Brian Anderson]

On Wed, Nov 23, 2016 at 10:22 AM, Florian Weimer <fw at deneb.enyo.de> wrote:

> * Sylvestre Ledru:
>
> >> The main solutions as I recall them were:
> >>
> >> 1) Vendor evering with Firefox, rustc, Cargo, crates, llvm and clang.
> Really
> >>   straightforward but distasteful to distros generally.
> >> 2) Upgrade Rust while continuing to use the same LLVM. This solution
> >> is hard to
> >>   count on because the work to keep Rust compatible with the older LLVM
> may be
> >>   great. It's also unlikely that rust-bindgen will be compatible with
> whatever
> >>   clang happens to be available.
> >> 3) Create new rust, LLVM, and clang packages mid-release, just for
> >> the purposes
> >>   of supporting the Firefox ESR upgrade.
> >> 4) Switch _off_ Firefox ESR's and establish an upgrade schedule, that
> matches
> >>   Firefox's / Rust's, as policy exceptions. Similar to how chromium
> >> as managed,
> >>   but the scale of software Firefox is upgrading is even larger (two
> >> compilers).
> >>
> >> So I'm not coming with any new solutions. Just want to check
> >> in. Sylvestre, Gus,
> >> Mike, anybody else, is there any new information? Is the way forward
> >> any clearer
> >> now? How can we make it clear?
>
> > This is an excellent summary. As packager of Rust and LLVM/clang,
> > the option 3) sounds reasonable if we can get an approval of the
> > Debian release management and security teams.
>
> I'm worried that this sets a precedent for forcing MFTLs into stable
> releases, and ongoing updates of them.  Another concern is that cargo
> isn't even going to make it into stretch, so why it would qualify for
> jessie is beyond me.
>

Not being deep into Debian, I'm confused about which releases are which,
and the statement that cargo isn't going to make it into stretch. I've been
assuming we were talking about the next stable Debian release, which looks
to me to be stretch, and that jessie is the current stable release. Are we
also talking about how to update Firefox in the current release, jessie,
which has no Rust whatsoever, mid-cycle? When does support for jessie end?

Why isn't cargo going to make it into stretch, and how can you tell that? I
see a status page [0] that seems to indicate cargo is in 'unstable' but not
'testing'. I guess since it's not in testing it's not going to be in the
next stable release (stretch). That seems like a complete showstopper for
Rust - Rust is not practically usable without Cargo. Do we have any options
for getting cargo into stretch?

[0]: https://tracker.debian.org/pkg/cargo




>
> Option 1 is really distasteful because we have to bootstrap Rust with
> pre-built binaries bundled with the sources.  Ocaml does the same
> thing, so it should be fine policy-wise, but it's still not what we
> generally strive for.  That's also a problem for option 4 (but I don't
> quite understand that one, it seems to be orthotogonal to the rest).
>
> Option 2 is just a choice of how to build Rust.  The only feasible way
> seems to be to use the bundled LLVM from upstream, considering that
> other things in the distribution might prevent us from upgrading LLVM
> as required by future Rust versions.
>
> Thinking out of the box, could Mozilla provide an apt-gettable archive
> for jessie and stretch which contains the official builds?  Then we
> could stop shipping Firefox.  This is what we ordinarily would do when
> faced with such challenges.
>

I do think that Mozilla providing its own deb archives is a very sensible
solution that can give us coverage of many Debian-derivatives. I'd strongly
advocate we do that even if we do expect to arrive at a solution with
Debian. It would give us peace of mind to know we had a working fallback
plan.


>
> To be clear, I don't have anything against Rust at all.  I'm playing
> with it right now, and it definitely shows great promise.  But the way
> Firefox's upstream choices force hour hands seems highly irregular.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/pkg-rust-maintainers/attachments/20161128/8e45f7e5/attachment.html>