Package: wnpp
Severity: wishlist
X-Debbugs-Cc: debian-devel@lists.debian.org, debian-rust@lists.debian.org
Owner: Riaan de Beer <rdebeer.infinityabundance@gmail.com>
* Package name    : rust-libxml-rs
  Version         : 0.1.0-alpha.11
  Upstream Author : infinityabundance
* URL             : https://github.com/infinityabundance/libxml-rs
* License         : MIT or Apache-2.0
  Programming Lang: Rust
  Description     : memory-safe replacement for libxml2 + libxslt + EXSLT

Hi,

Adding full details for the WNPP entry.

WHAT IT IS

libxml-rs is a native-Rust, forensic reimplementation of
libxml2 + libxslt + EXSLT + xsltproc.

- Not a wrapper, not a binding
- Does not link system libxml2/libxslt (verified by oracle)
- C ABI compatible: provides libxml2.so.2, libxslt.so.1
- License: MIT OR Apache-2.0

STATUS: Phase 9 complete

libxml2:
    * parser + SAX2 with proper namespace resolution
    * tree, XPath 1.0, XPointer, HTML, Reader/Writer
    * validation: DTD, XSD, RELAX NG, Schematron
    * C14N, XInclude, Catalog, I/O, Encoding, Regex, URI

libxslt:
    * full XSLT 1.0: templates, patterns, variables, keys,
    sorting, numbering, imports, security
    * 33 C symbols exported

EXSLT + xsltproc:
    * all 7 modules: exsl:, math:, set:, str:, dyn:, date:, func:
    * exsl:node-set with real RTF support
    * exsltRegisterAll() C export
    * xsltproc CLI: full options (--param, --output, --html, etc.)
        + upstream exit codes 1-11

QUALITY

    * 1110 lib tests, 0 failures
    * 12-case xsltproc corpus byte-identical to libxslt 1.1.45
    (stdout + exit codes)
    * ABI courts passing (struct / symbol / enum)
    * Oracle Docker: libxml2 2.12.0 + libxslt 1.1.39 from source
    * Builds: cdylib + staticlib + rlib
    * Emits: libxml-2.0.pc, libxslt.pc, xml2-config, SONAME symlinks

LINKS

  GitHub: https://github.com/infinityabundance/libxml-rs
  Crate:  https://crates.io/crates/libxml-rs (0.1.0-alpha.11)
  Parity: atlas/PARITY_MATRIX.md
  Ledger: atlas/RESIDUAL_LEDGER.md

WHY FOR DEBIAN

  libxml2 is unmaintained since Dec 2025 and is one of the most
  CVE-heavy essential libs. Used by:

    - BIND 9.20 (statistics-channels)
    - PHP, Python lxml, Ruby Nokogiri, PostgreSQL XML, LibreOffice

  I built this for bind9-rs, a memory-safe BIND rewrite.
  Without a safe libxml2, bind9-rs cannot be fully safe.

PACKAGING PLAN

    * Name: rust-libxml-rs
    * Salsa: rust-team/rust-libxml-rs
    * Target: experimental first, as alternative provider
    * Not a flag-day replacement of src:libxml2
    * Autopkgtest: oracle + byte-identical xsltproc corpus
    * Maint: Rust team + me, with review from XML/SGML team

Next: I will post to debian-devel with this bug number.

Thanks,
Riaan