#907629 librsvg: Embedded code copies: assorted Rust libraries

Package:
src:librsvg
Source:
librsvg
Submitter:
Simon McVittie
Date:
2023-03-30 09:54:04 UTC
Severity:
normal
Tags:
#907629#5
Date:
2018-08-30 10:38:09 UTC
From:
To:
librsvg contains "vendored" copies of various Rust libraries. Ideally
we would use the vendored copy or the system copy of each library,
whichever is (compatible and) newer, but I don't know enough Rust to
know how to do that (and set the right Built-Using) for a package that
is not built with dh-cargo.

We can't use dh-cargo because the Rust code here is only part of a larger
package that uses an Autotools build system.

Some of the vendored libraries are available in Debian, others are not:

[x] aho-corasick
[ ] alga
[x] ansi_term
[ ] approx
[x] arrayvec
[x] atty
[ ] backtrace
[ ] backtrace-sys (in NEW)
[x] bitflags
[ ] bitflags-0.9.1
[x] byteorder
[ ] c_vec
[ ] cairo-rs
[ ] cairo-sys-rs
[ ] cast
[x] cc
[ ] cfg-if
[x] chrono
[x] clap
[x] cloudabi
[ ] criterion
[ ] criterion-plot
[ ] criterion-stats
[ ] crossbeam-deque
[x] crossbeam-epoch
[x] crossbeam-utils
[ ] cssparser
[ ] cssparser-macros
[x] csv
[x] csv-core
[ ] downcast-rs
[x] dtoa
[ ] dtoa-short
[x] either
[ ] failure
[x] failure_derive
[ ] float-cmp
[x] fuchsia-zircon
[x] fuchsia-zircon-sys
[x] generic-array
[ ] glib
[ ] glib-sys
[ ] gobject-sys
[ ] handlebars
[x] itertools
[ ] itertools-num
[x] itoa
[x] lazy_static
[x] libc
[x] log
[x] matches
[ ] matrixmultiply
[x] memchr
[x] memoffset
[ ] nalgebra
[x] nodrop
[ ] num-complex
[x] num-integer
[x] num-traits
[ ] num-traits-0.1.43
[x] num_cpus
[ ] owning_ref
[ ] pango
[ ] pango-sys
[ ] pangocairo
[ ] pangocairo-sys
[ ] pest
[ ] pest_derive
[ ] phf
[ ] phf_codegen
[ ] phf_generator
[x] phf_shared
[x] pkg-config
[x] proc-macro2
[ ] procedural-masquerade
[x] quick-error
[x] quote
[ ] quote-0.3.15
[x] rand
[ ] rand-0.4.2
[x] rand_core
[ ] rawpointer
[ ] rayon
[ ] rayon-core
[x] redox_syscall
[x] redox_termios
[x] regex
[x] regex-syntax
[x] rustc-demangle
[ ] scopeguard
[x] serde
[x] serde_derive
[x] serde_json
[ ] simplelog
[x] siphasher
[ ] smallvec
[ ] stable_deref_trait
[x] strsim
[x] syn
[ ] syn-0.11.11
[ ] synom
[x] synstructure
[ ] term
[x] termion
[x] textwrap
[ ] thread-scoped
[x] thread_local
[x] time
[x] typenum
[x] ucd-util
[x] unicode-width
[x] unicode-xid
[ ] unicode-xid-0.0.4
[x] unreachable
[x] utf8-ranges
[x] vec_map
[x] void
[x] winapi

Some of the vendored libraries are only there as developer dependencies,
but "cargo test" requires that we have them anyway, as far as I can see.
Perhaps the solution is to not run "cargo test"; I don't know.

    smcv

#907629#10
Date:
2018-10-16 02:45:00 UTC
From:
To:
Hi, you are welcome to package the below dependencies as part of the Rust team. All our packaging is in one repo:

https://salsa.debian.org/rust-team/debcargo-conf/

It should be possible to use dh-cargo in librsvg's build, you might have to call it using something like:

override_dh_auto_install:
	# other stuff
	dh_auto_install -S cargo -D <path/to/crate/src>

Done this way, it will also omit `cargo test` so you don't have to worry about dev-dependencies. If you want to run those as well then you'll need to package them, and then add:

override_dh_auto_test:
	# other stuff
	dh_auto_test -S cargo -D <path/to/crate/src> -- test

Note that without the "test" at the end dh-cargo will only run a *cargo build*, this is by design, see https://salsa.debian.org/rust-team/debcargo/issues/15 for details.

Please feel free to ask any other questions.

X

#907629#15
Date:
2018-10-16 08:16:20 UTC
From:
To:
Sorry, I don't know Rust, so having me try to maintain anything exclusively
written in Rust would be a very bad idea :-)

librsvg runs `cargo build` during its own build: running `make` compiles
C code, then calls `cargo build` to compile Rust code that depends on the
C, then compiles some more C code that depends on the Rust. I don't think
we can avoid that.

It might be possible to patch Makefile.am to use dh_auto_build or
dh_auto_install instead of `cargo build`, but that's "inside out" compared
with a normal Debian package build, so I'd be far from confident about
making that change myself.

    smcv

#907629#20
Date:
2018-10-16 15:15:00 UTC
From:
To:
Simon McVittie:

Knowing Rust is not required to package Rust Debian packages, just understanding of how dependencies work and our tooling, all of which comes with a lot of documentation on exactly what to do. :)

I'd strongly recommend trying it at least, we add a bunch of flags in dh-cargo to do various nice things like honour Debian's LDFLAGS, pass in reproducible-builds flags, support cross-compilation, add debuginfo, support parallel building, avoid needing dev-dependencies, etc etc.

https://salsa.debian.org/rust-team/dh-cargo/blob/master/cargo.pm#L145

Actually I realise that one also needs to call `dh_auto_configure -S cargo` which will create the relevant cargo.toml in debian/cargo_home.

To build, the invocation is something like `cargo --verbose --verbose --target $(DEB_HOST_RUST_TYPE) -j$(parallel) -Zavoid-dev-deps` but dh_auto_test will do this for you.

X

#907629#25
Date:
2018-11-17 22:58:48 UTC
From:
To:
We have such little experience with rust (and time to invest in
learning more about it) in the Debian GNOME team that I think it would
be best if you submit merge proposals that you've tested and appear to
work.

Thanks,
Jeremy Bicha

#907629#30
Date:
2018-11-30 03:46:00 UTC
From:
To:
Ximin Luo:

For librsvg, it should be sufficient to add a build-depends on python3:native, and add something like this to your d/rules:

PATH := /usr/share/cargo/bin:$(PATH)
export PATH

override_dh_auto_configure:
	cargo prepare-debian $(CURDIR)/vendor

Later, when this bug is fixed and you stop depending on vendored libraries, the configure override can be changed to:

override_dh_auto_configure:
	cargo prepare-debian /usr/share/cargo/registry

X

#907629#35
Date:
2022-12-23 22:17:57 UTC
From:
To:
Hi all. I ran cargo debstatus against the cloned librsvg repo. This neat tool resolves crate dependencies and show then in a graph. I attached my (amended) result.
What's missing:

- pango + GTK libs: blocked by #1017905
- clap v4.0.29: a lot
- nalgebra: 4 reverse dependencies
- simba: 2 reverse dependencies
- rctree: no missing dependencies
- lopdf: one reverse dependencies
-yeslogic-fontconfig-sys: no missing dependencies
cssparser and dataurl can be updated/patched. I think plugwash might package clap v4 since he maintains clap. The GTK stack can't be updated unless 1017905 is fixed imho. I started working on it, but it is still a lot (44+ crates). I can look into the dependencies not affected by GTK or clap.

werdahias

#907629#40
Date:
2023-03-30 09:36:09 UTC
From:
To:
Hi,

now that clap4 is in debian and I have updated the whole GTK stack, it boils down to a lot less dependencies:

- pango/cairo: some libs- nalgebra: 4 reverse dependencies- simba: 2 reverse dependencies- rctree: no missing dependencies- lopdf: one reverse dependencies-yeslogic-fontconfig-sys: no missing dependenciescssparser and dataurl can be updated/patched.
Some crates look like they need updating. It's definitely doable to package the remaining dependencies and (possibly) devendor librsvg.
--- Matthias Geiger (werdahias)