On Thu, 18 Jun 2026 09:27:00 +0200, Manfred Hollstein wrote: > > Hi there, > > there is a discussion going on on the Xfce developer list at > [email protected]: > > Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor > > From my packager point of view, I must admit that I really hate using > Rust and Cargo within a package to be built in OBS, e.g. firefox-esr can > really be a pita when changes to our llvm/cargo/rust stack requires > changes to elements from the dependency chain, which would normally > handled by cargo downloading the stuff from Crate.io. This is verboten, > of course, so you end up either creating a new vendor.tar file or > patching checksums in the Cargo.lock file (this was necessary for > firefox-esr and MozillaThunderbird with the latest update to glibc-2.43 > recently). > > I sent my reasoning to the list, but wanted to hear about your opinion > on this topic.
I guess that the packaging itself would work, despite of being a bit more complexity. TW follows the latest Rust version, and IIUC, Leap 16.x will take (relatively) newer ones at each SP bump, too. But my concern is the handling of security issues. That can be tougher than normal packages if the fix is needed in the dependent crates, and nowadays you receive CVEs everyday. thanks, Takashi
