Hi,
Adding full details for the WNPP entry.
WHAT IT IS
libxml-rs is a native-Rust, forensic reimplementation of
libxml2 + libxslt + EXSLT + xsltproc.
- Not a wrapper, not a binding
- Does not link system libxml2/libxslt (verified by oracle)
- C ABI compatible: provides libxml2.so.2, libxslt.so.1
- License: MIT OR Apache-2.0
STATUS: Phase 9 complete
libxml2:
* parser + SAX2 with proper namespace resolution
* tree, XPath 1.0, XPointer, HTML, Reader/Writer
* validation: DTD, XSD, RELAX NG, Schematron
* C14N, XInclude, Catalog, I/O, Encoding, Regex, URI
libxslt:
* full XSLT 1.0: templates, patterns, variables, keys,
sorting, numbering, imports, security
* 33 C symbols exported
EXSLT + xsltproc:
* all 7 modules: exsl:, math:, set:, str:, dyn:, date:, func:
* exsl:node-set with real RTF support
* exsltRegisterAll() C export
* xsltproc CLI: full options (--param, --output, --html, etc.)
+ upstream exit codes 1-11
QUALITY
* 1110 lib tests, 0 failures
* 12-case xsltproc corpus byte-identical to libxslt 1.1.45
(stdout + exit codes)
* ABI courts passing (struct / symbol / enum)
* Oracle Docker: libxml2 2.12.0 + libxslt 1.1.39 from source
* Builds: cdylib + staticlib + rlib
* Emits: libxml-2.0.pc, libxslt.pc, xml2-config, SONAME symlinks
LINKS
GitHub: https://github.com/infinityabundance/libxml-rs
Crate: https://crates.io/crates/libxml-rs (0.1.0-alpha.11)
Parity: atlas/PARITY_MATRIX.md
Ledger: atlas/RESIDUAL_LEDGER.md
WHY FOR DEBIAN
libxml2 is unmaintained since Dec 2025 and is one of the most
CVE-heavy essential libs. Used by:
- BIND 9.20 (statistics-channels)
- PHP, Python lxml, Ruby Nokogiri, PostgreSQL XML, LibreOffice
I built this for bind9-rs, a memory-safe BIND rewrite.
Without a safe libxml2, bind9-rs cannot be fully safe.
PACKAGING PLAN
* Name: rust-libxml-rs
* Salsa: rust-team/rust-libxml-rs
* Target: experimental first, as alternative provider
* Not a flag-day replacement of src:libxml2
* Autopkgtest: oracle + byte-identical xsltproc corpus
* Maint: Rust team + me, with review from XML/SGML team
Next: I will post to debian-devel with this bug number.
Thanks,
Riaan
On Sat, Aug 29, 2026 at 1:59 PM Debian Bug Tracking System <
[email protected]> wrote:
> Thank you for filing a new Bug report with Debian.
>
> You can follow progress on this Bug here: 1146060:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146060.
>
> This is an automatically generated reply to let you know your message
> has been received.
>
> Your message is being forwarded to the package maintainers and other
> interested parties for their attention; they will reply in due course.
>
> As you requested using X-Debbugs-CC, your message was also forwarded to
> [email protected], [email protected]
> (after having been given a Bug report number, if it did not have one).
>
> Your message has been sent to the package maintainer(s):
> [email protected]
>
> If you wish to submit further information on this problem, please
> send it to [email protected].
>
> Please do not send mail to [email protected] unless you wish
> to report a problem with the Bug-tracking system.
>
> --
> 1146060: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146060
> Debian Bug Tracking System
> Contact [email protected] with problems
>
