Re: Librsvg 2.41.0 is released


A couple of thoughs inline below...

On Thu, 05 Jan 2017 20:58:48 -0600, Michael Catanzaro <mcatanzaro gnome org> wrote:
On Thu, 2017-01-05 at 19:25 -0600, Federico Mena Quintero wrote:
That *will* download, compile, and link stuff like gtk-rs statically
into  I don't think this is a problem in the long term: 
with things like Flatpak we are already moving away from distros
to mandate which dependencies one uses, and moving towards developers
making that choice on their own.


It's a total blocker for inclusion in Fedora, where builds have no
network access, and where we are very strongly discouraged from linking
to libraries like gtk-rs. I imagine openSUSE is going to have the same
network access problem, right? Have you tried building it on OBS?

Regarding not having network access when building: There is "cargo fetch" if
it's okay to download things in a separate step. One could potentially take a
snapshot of the dependencies needed to build librsvg, make a tarball with
them, and unpack them in the proper location. Then "cargo build" doesn't need
to fetch things itself. For more on this, there's interesting comments here:

Could you elaborate on what's the issue with gtk-rs? The way things work, the
code from it will be statically linked into librsvg, and if librsvg uses
actual {GTK+,GLib,cairo} functions, then librsvg links *dynamically* to
lib{gtk+,glib,cairo} (the ones made in C) as it would do anyway before when
Rust wasn't used. Only the glue bits from gtk-rs which allow to use the
libraries from Rust are linked into librsvg. Honestly, I fail to see how this
is a problem.

We all want the new Rustified librsvg to make its way into
distributions as soon as possible. I doubt it's going to happen anytime
soon so long as the build involves cargo, so I really hope we can find
some solution to this. Rust is critical to hardening future GNOME
software against attackers, and it's awesome that Federico has been
pushing this forward with librsvg. Now we surely don't want some silly
build system issue blocking that from going out to users.

I think most of the negative reactions against cargo come from the fact that
people don't think about it as “it is a build tool, like Make”, but instead
as “it is a package manager, WARNING, WARNING, rpm/apt/whatever is in danger”.

(It certainly can do more things, but “build tool” is exactly how it's used
for librsvg.)

I also don't agree that Flatpak makes static linking acceptable for
librsvg, because librsvg is a very important platform library and part
of our GNOME runtime. We're probably going to want to have gtk-rs in
the runtime sooner or later to promote Rust development, right? Surely
we're not going to want two different copies of it there.

Wrong. The way things are, gtk-rs is only needed at build time.

Hope the clarifications/ideas above can help.


 🚋 Adrián

Attachment: pgpLzP8uPL_27.pgp
Description: PGP signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]