On Mon, 22 Jun 2026 12:05:14 +0200, Manfred Hollstein wrote: > > Hi Maurizio, > > On Mon, 22 Jun 2026, 05:35:02 +0200, Maurizio Galli wrote: > > Manfred Hollstein wrote: > > > Hi there, > > > > > > there is a discussion going on on the Xfce developer list at > > > [email protected]: > > > > > > Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor > > > > > > From my packager point of view, I must admit that I really hate using > > > Rust and Cargo within a package to be built in OBS, e.g. firefox-esr can > > > really be a pita when changes to our llvm/cargo/rust stack requires > > > changes to elements from the dependency chain, which would normally > > > handled by cargo downloading the stuff from Crate.io. This is verboten, > > > of course, so you end up either creating a new vendor.tar file or > > > patching checksums in the Cargo.lock file (this was necessary for > > > firefox-esr and MozillaThunderbird with the latest update to glibc-2.43 > > > recently). > > > > > > I sent my reasoning to the list, but wanted to hear about your opinion > > > on this topic. > > > > > Having packaged xfwl4 I admit it was a PITA to figure out the bits. > > However there is no alternative in sight to bring Xfce window manager > > + compositor to Wayland so I have no complaints. That's the way > > upstream wants to go then, so be it. > > Thanks for your SR of xfwl4, I just approved it. As Wayland was a > necessity for Leap 16.0 which made especially Takashi pushing those bits > forward to get Xfce added to the installation media, we need to find a > way to make the unresolvables for 16.0 resolvable ;-)
Yep :) > While we certainly cannot force upstream to change their opinion on > Cargo, I'll definitely keen to see how they'll deal with security > updates in that dependency chain as Takashi pointed out. I believe that most of the security update problem is rather distro-specific. Basically for the upstream, they just need to fix the latest code or update Config.toml for the dependent crates, and release; that's all. OTOH, for us distros that ship the older versions, we need to handle differently, and Rust packaging makes a bit harder than others (although it's always doable). Takashi
