+pkg-mozilla-maintainers Julien Cristau: > On Fri, Aug 26, 2016 at 06:59:20 +0000, Angus Lees wrote: > >> Dear SRMs, >> >> My understanding is that Debian's new-ish plan is to update firefox-esr >> versions in stable when there is a security update and the firefox-esr >> upstream support window for the previous version has expired. >> What is the plan for handling any new build-deps this new firefox-esr >> release might require, and how will they also be merged into the existing >> stable release? >> > I would expect firefox to bundle rustc, if needed, rather than relying > on an external not-in-stable package. But I'm just a bystander, and the > actual plan is in the hands of the firefox maintainer(s) and security > team, not the release team. >
(shall I drop debian-release@ off this thread?) If Firefox bundles rustc, it would also have to bundle llvm. This is quite a lot of code to be bundling, almost doubling the source size. It would also increase its build time 4.5x, from ~1 hour to 4.5 hours (on a fast buildd machine [1][2][3][4]; my own machine is about 2x as slow). rustc and llvm-3.8 will be in the next Debian stable, which is quite soon. And if I understood correctly, the future Firefox-with-rust build will use stable releases of rustc. These are released every 6 weeks, roughly on the same schedule as firefox-esr updates. The LLVM requirements stay the same across multiple releases. I think it would be not much effort to keep backporting rustc to Debian stable to keep up with firefox-esr. rustc does not have other strictly-versioned dependencies apart from LLVM, so the backporting work would be minimal. (cargo is harder, but it's also much smaller and quicker to build, so I think it's less of a problem to bundle that. Also right now Firefox-with-rust would be using cargo nightly; I don't know yet if they have plans to change this.) X [1] https://buildd.debian.org/status/fetch.php?pkg=firefox&arch=arm64&ver=48.0-1&stamp=1470231782 [2] https://buildd.debian.org/status/fetch.php?pkg=rustc&arch=arm64&ver=1.10.0%2Bdfsg1-3&stamp=1469947147 [3] https://buildd.debian.org/status/fetch.php?pkg=llvm-toolchain-3.8&arch=arm64&ver=1%3A3.8.1-9&stamp=1471437328 -- GPG: ed25519/56034877E1F87C35 GPG: rsa4096/1318EFAC5FBBDBCE https://github.com/infinity0/pubkeys.git