Hi, A couple of thoughs inline below... On Thu, 05 Jan 2017 20:58:48 -0600, Michael Catanzaro <mcatanzaro gnome org> wrote:
On Thu, 2017-01-05 at 19:25 -0600, Federico Mena Quintero wrote:That *will* download, compile, and link stuff like gtk-rs statically into librsvg.so. I don't think this is a problem in the long term: with things like Flatpak we are already moving away from distros trying to mandate which dependencies one uses, and moving towards developers making that choice on their own.Hi, It's a total blocker for inclusion in Fedora, where builds have no network access, and where we are very strongly discouraged from linking to libraries like gtk-rs. I imagine openSUSE is going to have the same network access problem, right? Have you tried building it on OBS?
Regarding not having network access when building: There is "cargo fetch" if it's okay to download things in a separate step. One could potentially take a snapshot of the dependencies needed to build librsvg, make a tarball with them, and unpack them in the proper location. Then "cargo build" doesn't need to fetch things itself. For more on this, there's interesting comments here: https://github.com/rust-lang/cargo/issues/1330 Could you elaborate on what's the issue with gtk-rs? The way things work, the code from it will be statically linked into librsvg, and if librsvg uses actual {GTK+,GLib,cairo} functions, then librsvg links *dynamically* to lib{gtk+,glib,cairo} (the ones made in C) as it would do anyway before when Rust wasn't used. Only the glue bits from gtk-rs which allow to use the libraries from Rust are linked into librsvg. Honestly, I fail to see how this is a problem.
We all want the new Rustified librsvg to make its way into distributions as soon as possible. I doubt it's going to happen anytime soon so long as the build involves cargo, so I really hope we can find some solution to this. Rust is critical to hardening future GNOME software against attackers, and it's awesome that Federico has been pushing this forward with librsvg. Now we surely don't want some silly build system issue blocking that from going out to users.
I think most of the negative reactions against cargo come from the fact that people don't think about it as “it is a build tool, like Make”, but instead as “it is a package manager, WARNING, WARNING, rpm/apt/whatever is in danger”. (It certainly can do more things, but “build tool” is exactly how it's used for librsvg.)
I also don't agree that Flatpak makes static linking acceptable for librsvg, because librsvg is a very important platform library and part of our GNOME runtime. We're probably going to want to have gtk-rs in the runtime sooner or later to promote Rust development, right? Surely we're not going to want two different copies of it there.
Wrong. The way things are, gtk-rs is only needed at build time. Hope the clarifications/ideas above can help. Cheers, — 🚋 Adrián
Attachment:
pgpLzP8uPL_27.pgp
Description: PGP signature