[HEADS-UP] Upcoming Rust SIG mini-mass-rebuild - Rust - Fedora mailing-lists

20 May 2024


      Hi all,
As discussed in the Fedora Rust channel on Matrix, I am planning to do
a mini-mass-rebuild of all Rust applications (that are co-maintained
by the Rust SIG), likely by the end of this week. I estimate that it
will involve just shy of 200 packages per branch.
The motivation for a mini-mass-rebuild is two-fold:
1. Until very recently, the Rust standard library (shipped as a static
archive by the "rust" package) was accidentally shipped with stripped
debuginfo, which resulted in Rust applications that linked the
standard library to have incomplete debuginfo - and as a result, they
produced incomplete backtraces for any stack traces that involved the
Rust standard library. This has been fixed since rust 1.78, but
applications need to be rebuilt to pick up this improvement.
2. I regularly rebuild applications for "major" / "high priority"
security issues in Rust crates, but there are a few accumulated
"minor" / "low priority" security issues where I didn't yet have the
time to rebuild the affected applications against the library versions
that contain the necessary fixes. A mini-mass-rebuild would take care
of all of these at the same time.
I plan to only rebuild Rust applications that are associated with the
Rust SIG (i.e. packages "rust-*"), but no other packages (for example,
firefox, thunderbird, or librsvg2). If any maintainers of packages
that contain Rust code but that are not co-maintained by the Rust SIG
would like their packages to be included in the mini-mass-rebuild as
well, just let me know and I'll add them to my list.
Fabio
PS: Packages that build with vendored Rust dependencies (there are a
handful of them, and most are not co-maintained by the Rust SIG) would
only benefit from better debuginfo / backtraces, but not from security
updates (that would require manually updating the vendor tarball),
which is why I will not include them in the mini-mass-rebuild.