GNU bug report logs - #32834
[PATCH] gnu: icecat: Build with rust-1.24.

Previous Next

Full log

View this message in rfc822 format

From: ludo <at> gnu.org (Ludovic Courtès)
To: Mark H Weaver <mhw <at> netris.org>
Cc: Danny Milosavljevic <dannym <at> scratchpost.org>, 32834 <at> debbugs.gnu.org, Efraim Flashner <efraim <at> flashner.co.il>
Subject: [bug#32834] [PATCH] gnu: icecat: Build with rust-1.24.
Date: Sun, 30 Sep 2018 21:27:33 +0200

Mark H Weaver <mhw <at> netris.org> skribis:

> Danny Milosavljevic <dannym <at> scratchpost.org> writes:
>
>> On Sat, 29 Sep 2018 23:55:36 +0200
>> ludo <at> gnu.org (Ludovic Courtès) wrote:
>>
>>> Hi Efraim,
>>> 
>>> Efraim Flashner <efraim <at> flashner.co.il> skribis:
>>> 
>>> > * gnu/packages/gnuzilla.scm (icecat)[native-inputs]: Use the oldest
>>> > compatable rust over newer releases when building icecat.  
>>> 
>>> [...]
>>> 
>>> > +      ;; Icecat 60 checkes for rust>=1.24
>>> > +     `(("rust" ,rust-1.24)
>>> > +       ("cargo" ,rust-1.24 "cargo")  
>>> 
>>> I suppose the goal is to reduce the build chain, right?
>>> 
>>> Mark, Danny: WDYT?
>>
>> I think it's a good idea.
>>
>> Eventually, the rust bootchain will change to mrustc -> rust <at> 1.25.0 -> ...,
>> but we can cross that bridge when we come to it.
>>
>> I'm not sure about Rust's policy with regard to CVEs.  Are those patched
>> in old releases, too?
>
> Indeed, that's my main concern.  Might the older Rust compilers have
> bugs that could lead to security flaws in IceCat?

I suppose vulnerabilities are more likely to be present in Rust’s
standard library than in the compiler, but the problem remains.  Given
the fast development pace, I’d be surprised if past releases received
security fixes.

> Here's another possible approach to mitigate the cost of building this
> long chain of Rust compilers: perhaps older versions of Rust could use
> only minimal and highly stable inputs, such that they would be built
> only once per core-updates cycle.  Thoughts?

If it’s possible, that’d be great.

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.