On 12/03/2026 22:09, Jonas Smedegaard wrote:
This change depends on crate rsa getting aligned first,
In order to avoid dealing with around two hundred packages at once we have decided to introduce semver-suffix packages for rand-core, rand-chacha and rand. This decision reduces the number of package we have to deal with at the same time, but it means that when packages use types/traits from rand-core in their APIs we have to be careful about when and how we move them from the old rand-core to the new. So the first phase of the rand stack update is primarily about updating getrandom. The new versions of rand, rand-core and rand-chacha will become available and can be used immediately for "simple" cases but more complex cases, such as packages that expose rand-core traits in thier APIs will be dealt with later, Ideally by updating them to new upstream versions. rsa is such a crate, it exposes rand-core traits in it's API, and unfortunately while a new upstream release has been in preperation for a while it seems to be taking a long time to finalise. The debdiff I attached for nanopub reflects what upstream did, and works fine. If you would prefer I can produce a smaller debdiff that only updates getrandom and doesn't touch any rand/rand-core related stuff. I hope that all makes sense.
