On April 19, 2024 7:09:15 PM GMT+02:00, Miguel Ojeda
<[email protected]> wrote:
>Hi Ximin, Sylvestre, Fabian, all,
>
>In Rust for Linux, we are considering using host-only/userspace Rust
>libraries (e.g. `syn`), and we were asked to check whether it would be
>possible to just pick them from the distribution (since, in principle,
>they don't require kernel-specific changes).
>
>What is the policy in Debian for those? I was told about
>`debcargo-conf` by Zixing Liu, and indeed I can see e.g. `syn` there
>in `librust-syn-dev`, which places the sources at
>`/usr/share/cargo/registry/`, which is great for what we need. Is that
>correct? This would be useful for kernel developers that do not trust
>third-party repositories (not even Rust's/crates.io/the upstream
>repository).
Yes, all crates packaged by the Rust team (and most packaged for consumption by
other packages/as build-deps by people outside of the team) ship their (patched
for distro use) sources in a subdir there. The patches (except for wholesale
exclusions of bundled C code and similar things, which is done via orig tarball
repacking) are also shipped there, so the delta is easily reviewable. The whole
directory structure can be used as (partial) drop-in for crates.io by
configuring cargo accordingly (in Debian packaging this is done by a cargo
wrapper shipped in /usr/share/cargo/bin/cargo, but that one is probably not
suitable as-is for kernel stuff - it or rather its output might serve as an
example for the needed cargo config runes though ;))
>By the way, is there a way to query where the sources are (i.e. that
>path) in a "standard" way (e.g. like `pkg-config`)? Or, at least, can
>we assume it should be stable? (e.g. for automated detection and/or
>instructions we may want to provide).
Not really - other than that directory being in the format the cargo expects
for registry replacement, which is the same structure as `cargo vendor`
creates. There is no index or .pc equivalent - the Cargo.toml file inside each
crate has all the info and more in a standardized fashion after all :)
I don't except this to change anytime soon (basically - only if stable dynamic
linking becomes feasible and we stop shipping the sources in binary packages
altogether ;) or if cargo itself completely revamps how it supports vendoring).
If we know people/projects outside of Debian packaging are using this, adding a
comment in the tooling that currently decides those paths (and their
contents/structure) so that we know we should discuss or at least give a heads
up about any planned fundamental changes should be easy to do :)
Don't hesitate to reach out if you have further questions or go ahead with
using the packaged crate sources!
While there is considerable overlap w.r.t. subscribers, there is a second
Debian rust list for discussions ([email protected]) - this one here
gets all the automated notifications for all team maintained packages, so is
rather high volume and things can get overlooked sometimes.
