On Wed, Nov 20, 2019 at 10:08, Alberto Planas Dominguez wrote:

On Tuesday, November 19, 2019 1:24:50 PM CET William Brown wrote:

...

The issue becomes fixes to vendored dependencies (of which there are ~200 I think total. I directly have ~30 deps). Fixes to kanidm are simple to patch and backport, but fixes for vendored code ... not so much. That's what will really be the issue is rust has no concept of a security update vs a feature one - and most crates treat them as the same - updates. So you will have a vendor library that will both have security *and* feature changes, which will quickly be a maintainers nightmare.

Vendoring can only be a temporary workaround until the crate ecosystem become more stable in OBS : (

Granted, somebody would need to use the crates at all, nobody does this far. However 250 and something of them are already in devel:languages:rust:crates. LCP [Stasiek] https://lcp.world -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On Wed, Nov 20, 2019 at 19:57, William Brown wrote:

...

On 20 Nov 2019, at 19:47, Stasiek Michalski wrote:

On Wed, Nov 20, 2019 at 10:08, Alberto Planas Dominguez wrote:

...

On Tuesday, November 19, 2019 1:24:50 PM CET William Brown wrote:

...

The issue becomes fixes to vendored dependencies (of which there are ~200 I think total. I directly have ~30 deps). Fixes to kanidm are simple to patch and backport, but fixes for vendored code ... not so much. That's what will really be the issue is rust has no concept of a security update vs a feature one - and most crates treat them as the same - updates. So you will have a vendor library that will both have security *and* feature changes, which will quickly be a maintainers nightmare. Vendoring can only be a temporary workaround until the crate ecosystem become more stable in OBS : (

Granted, somebody would need to use the crates at all, nobody does this far. However 250 and something of them are already in devel:languages:rust:crates.

The crate system will never stabilise - that's the issue - you have hundreds of crates vying to get the latest compiler features, and projects that depend on them, and will set their versions accordingly. And because crates.io / rust has no concept of a security update vs feature update, we'll have to update all the time.

If we try to package crates, we'll be forever in a mountain of continual reviews and packaging.

But if we just focus on leaf packages which have vendored deps and the compiler, that's much more manageable.

We have to focus on value for our time - is it worth our time to be doing the crates? Or the projects that people use?

I think it's worth really highlighting *rust is not C*. We can not take our traditional package ideals and apply it to rust else we'll fail. We need to think about this differently. That's my point here. If we can't even keep the compiler up to date with what projects need, how are we going to maintain hundreds of crate versions?

rust2rpm allows us to package crates in minutes, having a script that does that automatically for all the crates with osc sounds fairly simple to do as well. LCP [Stasiek] https://lcp.world -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On Wed, Nov 20, 2019 at 13:04, Richard Biener wrote:

On Wed, 20 Nov 2019, Stasiek Michalski wrote:

...

rust2rpm allows us to package crates in minutes, having a script that does that automatically for all the crates with osc sounds fairly simple to do as well.

But then you have CI for Factory and that minutes turn into weeks :P

That's a downside to QA process, not the packaging issue anymore. As far as I know we are discussing packaging right now, aren't we? LCP [Stasiek] https://lcp.world -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

Hi, On Wed, 20 Nov 2019, William Brown wrote:

The crate system will never stabilise - that's the issue - you have hundreds of crates vying to get the latest compiler features, and projects that depend on them, and will set their versions accordingly. And because crates.io / rust has no concept of a security update vs feature update, we'll have to update all the time.

If we try to package crates, we'll be forever in a mountain of continual reviews and packaging.

But if we just focus on leaf packages which have vendored deps and the compiler, that's much more manageable.

We have to focus on value for our time - is it worth our time to be doing the crates? Or the projects that people use?

A good point indeed.

I think it's worth really highlighting *rust is not C*. We can not take our traditional package ideals and apply it to rust else we'll fail. We need to think about this differently. That's my point here. If we can't even keep the compiler up to date with what projects need, how are we going to maintain hundreds of crate versions?

I see only some ways for the enterprise (or other more stable) distros, and all are terrible: a) bundle rustc itself (not just the other deps) with the packages requiring it. I hear that's what they call "vendoring". b) continously update the one and only rustc compiler in distros (also the enterprise ones). Supposedly rust is backward compatible, so that should continue to be able to compile older sources like librsvg which we might not want to contiously update in the enterprise distros. I would not trust this claim from a community that happily changes language and standard library every six weeks, I don't think they have a mental model of what stability really means. c) provide two rustc compilers in parallel, one remaining stable for building the packages we don't (continously) update and another that quickly updates. Whatever we choose (the only realistic option seems (c) to me), we should make fairly sure that we do _not_ encode any requirements on Rust into base components of our system (librsvg comes to mind, and it is a huge problem that parts are written in Rust; it's a basic component and hinders the Risc-V distro, we have to keep using an old version of libsvg there). It's simply not a good decision to base system components on a quickly changing eco system. In that vain I doubt your choice of using Rust in 389-ds is a very good one; please think hard about the consequences for distros that want to be maintained the next 20 years. You are right that we can't make that choice for other people wanting to use the next fancy language (though we sometimes can in not using what they produce), but you can make that choice for yourself and have to balance the wish for nice language features against the downsides of that eco system. (I personally think requiring an eco system that's only N<4 years old, and is _known_ to change extremely fast, for system components (in comparison to hobby projects or only using it optionally), is actually more than a mere bad choice, it's bordering on irresponsible software design) Ciao, Michael.

...

LCP [Stasiek] https://lcp.world

-- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

— Sincerely,

William Brown

Senior Software Engineer, 389 Directory Server SUSE Labs

-- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On Nov 20 2019, Michael Matz wrote:

Funny story about this in this context: Rust doesn't work on Risc-V because it bundles (vendors, ahem) an old version of llvm. Newer versions of llvm that work on risc-v do exist, but they can't be used in rust easily, because, well, ... the llvm eco-system is changing too fast for them it seems ;-)

To clarify, rust master is following the llvm 9 branch, but that isn't ready for RISC-V yet. The llvm master branch fully supports RISC-V now, but that is still a fast moving target. Another issue is that rust depends on the libc crate, which has no support for RISC-V yet, and the arcane rust build system makes it really hard to use a patched crate. Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different." -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On 11/20/19 11:07 AM, Michael Matz wrote:

Funny story about this in this context: Rust doesn't work on Risc-V because it bundles (vendors, ahem) an old version of llvm. Newer versions of llvm that work on risc-v do exist, but they can't be used in rust easily, because, well, ... the llvm eco-system is changing too fast for them it seems ;-)

Actually, in Debian, the rustc package uses the LLVM package from the system and in my experience this works reasonably well these days. I don't actually know why no one has added the risc64-unknown-linux-gnu spec to Rust upstream yet, but if no one is going to do that until the end of the year, I'm going to do that during the Christmas holidays. Otherwise, I fully agree with what you said in your previous mail. We have already had the same discussion in Debian. It caused so much traction, it was actually in the news on LWN [1] ;). Debian's librsvg maintainer uploaded the rustified version of the library just after I managed to bootstrap the Rust compiler on all release architectures in Debian [2] which was the result of a lot of debugging and bug fixing. I actually felt betrayed because I'm also one of the maintainers of most unofficial architecture ports in Debian (Debian Ports), so I was not particularly amused about this upload. If Rust upstream finally realized that a stable language and API isn't just some archaic and pointless construct, the language would certainly receive a much wider adoption with alternative compiler implementations being available. Adrian

[1] https://lwn.net/Articles/771355/ [2] https://lists.debian.org/debian-devel-announce/2018/11/msg00000.html

On 11/20/19 12:43 PM, Andreas Schwab wrote:

On Nov 20 2019, John Paul Adrian Glaubitz wrote:

...

Actually, in Debian, the rustc package uses the LLVM package from the system and in my experience this works reasonably well these days. I don't actually know why no one has added the risc64-unknown-linux-gnu spec to Rust upstream yet,

Probably because llvm9 doesn't work yet on riscv.

But Rust upstream has already riscv support, just not for the linux-gnu ABI. Adrian

On Nov 20 2019, John Paul Adrian Glaubitz wrote:

But Rust upstream has already riscv support, just not for the linux-gnu ABI.

There is a lot of room between cross and native support. Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different." -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On Nov 20 2019, Ludwig Nussel wrote:

Is the C librsvg still ABI compatible?

It still uses the same soname, but of course, that doesn't tell much. Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different." -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org