* Package name    : rust-p9
  Version         : 0.3.3~git20260608.18e31a4
  Upstream Contact: Daniel Verkamp <dverkamp@chromium.org>
* URL             : https://github.com/google/rust-p9
* License         : BSD-3-Clause
  Programming Lang: Rust
  Description     : server implementation of the 9P filesystem protocol

A server-side implementation of the 9P filesystem protocol in Rust, written
for ChromiumOS and published by Google. crosvm uses it for its virtio-9p
device, which is how a guest is given access to a directory on the host.

I need it to package crosvm (#1026126). With the feature set
qcow,balloon,net,usb,audio, crosvm pulls in 107 crates from crates.io, of
which 105 are already in Debian; p9 and its proc-macro p9_wire_format_derive
are the only two missing. My own motivation is a crosvm backend for
syzkaller, so that Linux kernel fuzzing can run under crosvm as well as QEMU.

One thing I would like a second opinion on, because it decides how this
should be packaged.

The newest version on crates.io is p9 0.3.2. It predates upstream commit
37ff802, "Prevent path traversal and sandbox escape in directory walking and
operations", which validates client-supplied path components and stops
filesystem operations escaping the exported root. Upstream bumped the version
to 0.3.3 for that fix but has never tagged or published it - crates.io still
ends at 0.3.2, and there is no v0.3.3 tag. So the only source carrying the
fix is git.

That matters more than it usually would. The consumer of this crate exports a
host directory into a virtual machine, so the exported root is a trust
boundary between guest and host, and the fix is precisely what defends it. I
do not think Debian should ship 0.3.2 as-is.

That leaves two options and I am happy with either:

  a) package the git snapshot, 0.3.3~git20260608.18e31a4, which is what I
     have prepared - one source package building librust-p9-dev and
     librust-p9-wire-format-derive-dev, at
https://salsa.debian.org/ysk/rust-p9 branch debian/latest; or

  b) package 0.3.2 and 0.3.0 from crates.io through debcargo-conf in the
     usual way, carrying 37ff802 as a quilt patch until upstream publishes.

(b) is the Rust team's normal route for a crates.io crate and I would default
to it if the team prefers; (a) avoids carrying a security patch in Debian and
gets the tested upstream code. I have the debcargo-conf side prepared too, so
either can go ahead. I will also ask upstream to publish 0.3.3.

Both variants build in a clean unstable chroot and are lintian clean at
-EviIL +pedantic apart from initial-upload-closes-no-bugs. Note for anyone
reviewing: the upstream test suite reopens file handles through /proc/self/fd
and so needs a mounted procfs; in a chroot without one, 44 of its 81 tests
fail with ENOENT and it is the chroot, not the code.

I am filing a separate ITP for p9_wire_format_derive, which p9 depends on,
in case the crates go in as two source packages.

I am not a Debian Developer, so I will need a sponsor.

We believe that the bug you reported is fixed in the latest version of
rust-p9, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144035@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yunseong Kim <ysk@kzalloc.com> (supplier of updated rust-p9 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 09 Aug 2026 19:03:34 -0500
Source: rust-p9
Binary: librust-p9-dev
Architecture: source amd64
Version: 0.3.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed-By: Yunseong Kim <ysk@kzalloc.com>
Description:
 librust-p9-dev - Server implementation of the 9p file system protocol - Rust sourc
Closes: 1144035
Changes:
 rust-p9 (0.3.2-1) unstable; urgency=medium
 .
   * Package p9 0.3.2 from crates.io using debcargo 2.8.4
   * Initial release (Closes: #1144035)
Checksums-Sha1:
 2e347c906dded3beea8cf2bba49fcc6a32aa7eb5 2298 rust-p9_0.3.2-1.dsc
 52b3a4c2660f4873010637cb30dcf501c60aa9e4 31304 rust-p9_0.3.2.orig.tar.gz
 c886bb004a2c3fbdbf87cf5132f82b10bafcc9dc 3024 rust-p9_0.3.2-1.debian.tar.xz
 ef9f996eeae3cb8ca9f531e7fe15c5551ac606a5 29672 librust-p9-dev_0.3.2-1_amd64.deb
 fc3d41c5781fd9a1706bf500f2c658c5d0542ec2 7327 rust-p9_0.3.2-1_amd64.buildinfo
Checksums-Sha256:
 eaf70c9905de9a299cc31083fed71b5af9fcd25e83eeb8516e401c5b193bd5b8 2298 rust-p9_0.3.2-1.dsc
 0dc5b2b13cb6a9a5fcf7c668ebf2aef67e0d83d4451c1db95feb9fb0775874f0 31304 rust-p9_0.3.2.orig.tar.gz
 58a52d2a16ba990e5e8417df02a80ea92f6249d0733c9f5b92ac040933a8f689 3024 rust-p9_0.3.2-1.debian.tar.xz
 989a3241da4e5c31a8c3e6a159ee9b49940bda9a561bc998837a43edf9d54885 29672 librust-p9-dev_0.3.2-1_amd64.deb
 1d37edf0e7c8f3d8867ea33eab53c65d727bcc730efbf504ca56d55ebddb32f7 7327 rust-p9_0.3.2-1_amd64.buildinfo
Files:
 9ef210a821dbd0a2e322fb7a0420bb02 2298 rust optional rust-p9_0.3.2-1.dsc
 a8b4d582b415cd5ce9c7d4cb65ce9eb1 31304 rust optional rust-p9_0.3.2.orig.tar.gz
 919fe10e4a605b7f3278b6f9ac3eeb45 3024 rust optional rust-p9_0.3.2-1.debian.tar.xz
 9b2ca27f101a05a18dbd6618705ce270 29672 rust optional librust-p9-dev_0.3.2-1_amd64.deb
 f1cf1b33be64dba4f98240768f3f276e 7327 rust optional rust-p9_0.3.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmp5FZEACgkQ4n8s+EWM
L6SZjw/8D4iOfc7hX7pmFZ6dxWIqlNytHcMRp6LsRAn0HJoqqVZBhH0NfD21q144
ajzqGavLCLLCqjYeHqskatubQJUo4OkuVrMHhnTqySwErRJNe3PfLb+YlfII/+fg
1ZoWL33ZWKexW3CyYb6O5ZpZvwP3r3yvsMth0JyF3PRI9mHYrU9P6biGKjy7/Vqr
TjVRxfnt0TZ61r4MUgfMdTet4apjNsi5LB0CM5vL2T+l20ShJWKMNzxW1j1cqz+2
IOGOkgVjUFfpOL4x621X8lBxhl8CLGPf+9l4O0qGt3UuEMrwmpb5VU9GXxDaDxFy
4KBf9yMdSOBLTf3bw/bG2XxaT69Rxtz5SYT7zRyPtyyrukL+v+kGkG/3DF8KWDrf
/r3trU66/L23fkT4c5LWvBBlm9qU4jdUZptpDiJc2ZuqmZr1XM0Oc8fVWntFSarp
CwnqZEIE2aL2znLTiFiFjDEVkBATBcEgtcVoFVljS9un7gVGuaEMTcc2K5bEatDW
f8z7a2oqylfsq7PEAHOhltswkUSg0CXVmY7HJzl8nGWllWEhDChoXVp2+OJqscGO
Ss1ONqw1GaQ7kvxkzFA6r/Zmyi66UlXfk29ATRJrQ1B6tFKH8MLW9UcwAr9ChGLf
ie4ouIcfWIPO+sha1tCaeFWvANgliEZ94dGO+K8p2XWVUPS/kFI=
=09Ef
-----END PGP SIGNATURE-----