Re: Librsvg 2.41.0 is released

[Michael Catanzaro <mcatanzaro gnome org>]

On Thu, 2017-01-05 at 19:25 -0600, Federico Mena Quintero wrote:
> That *will* download, compile, and link stuff like gtk-rs statically
> into librsvg.so.  I don't think this is a problem in the long term: 
> with things like Flatpak we are already moving away from distros
> trying
> to mandate which dependencies one uses, and moving towards developers
> making that choice on their own.

Hi,

It's a total blocker for inclusion in Fedora, where builds have no
network access, and where we are very strongly discouraged from linking
to libraries like gtk-rs. I imagine openSUSE is going to have the same
network access problem, right? Have you tried building it on OBS?

We all want the new Rustified librsvg to make its way into
distributions as soon as possible. I doubt it's going to happen anytime
soon so long as the build involves cargo, so I really hope we can find
some solution to this. Rust is critical to hardening future GNOME
software against attackers, and it's awesome that Federico has been
pushing this forward with librsvg. Now we surely don't want some silly
build system issue blocking that from going out to users.

I also don't agree that Flatpak makes static linking acceptable for
librsvg, because librsvg is a very important platform library and part
of our GNOME runtime. We're probably going to want to have gtk-rs in
the runtime sooner or later to promote Rust development, right? Surely
we're not going to want two different copies of it there.

On Thu, 2017-01-05 at 19:25 -0600, Federico Mena Quintero wrote:
> If you really want to avoid librsvg 2.41 for jhbuild, then hardcode
> it
> to the 2.40.16 tarball.  I will not be doing any maintenance on the
> 2.40 series anymore.
>  
> In the meantime, build systems are really not my thing, and I would
> appreciate help in making this all work with jhbuild / gnome-
> continuous.

I have it working in jhbuild now with that branch (which points to your
2.40.16 commit). I could just as well have used a tarball; no
preference from me there.

By the way, is 2.41.0 a stable release? Maybe should we call it 2.42.0
then? cargo aside, packagers are kinda trained to ignore those odd
minor versions and might need some prodding to realize it should be
shipped.

Michael