On Tue, 15 Aug 2023 at 18:41:49 +0200, Matthias Geiger wrote: > the latest rsvg would need ~ 10 NEW rust packages if it were to be > devendored. iirc you can actually run "cargo vendor" and it would revendor > the tarball (even with out upstream vendoring it).
Given the policy that Jeremy linked to, I imagine Ubuntu will want to produce a fully-vendored tarball, even if Debian does not. Producing a fully-vendored tarball of 2.55 or higher would be the closest thing to the status quo, so I think that would be a valid way to update librsvg, even if the Debian Rust team would prefer us to do it differently. Is it possible to vendor *some* dependencies, and take others from Debian? That seems a lot more feasible to me than de-vendoring literally everything, and in particular would avoid librsvg getting stuck behind a new Rust library getting through NEW. smcv