Conill: The long-term consequences of maintainers’ actions [LWN.net]

Conill: The long-term consequences of maintainers’ actions

Posted Sep 17, 2021 19:43 UTC (Fri) by ariadne (subscriber, #138312)
In reply to: Conill: The long-term consequences of maintainers’ actions by josh
Parent article: Conill: The long-term consequences of maintainers’ actions

> This hasn't been that much of an issue for other Linux distributions. Yes, newer software requires newer Rust, but stable distributions typically keep the same base version of Rust and the same base version of other software.

It isn't that it is an issue per se, it's that policy (both in rust, and in Alpine) is presently not quite on the same page. Other distributions begrudgingly upgrade rust in already released branches when needed, but only because they have to in order to support the security updates of other software. Firefox is an example here.

I would personally love to see Rust have a full support lifecycle in Alpine. This will probably come as Ferrocene plays out, which will provide LTS versions of Rust. I expect most distributions will switch to using Ferrocene, and this will all be behind us at that point.

to post comments

Conill: The long-term consequences of maintainers’ actions

Posted Sep 17, 2021 19:52 UTC (Fri) by josh (subscriber, #17465) [Link] (2 responses)

> Other distributions begrudgingly upgrade rust in already released branches when needed, but only because they have to in order to support the security updates of other software. Firefox is an example here.

This seems like a fundamental incompatibility between Firefox's security model and the distribution security model. Upgrading to a new major version of something can mean upgrading to new versions of its dependencies. That's true for any piece of software.

Perhaps it would make sense to have a version of Rust in the distribution used as a dependency of Firefox (and anything else that uses the "you must upgrade to a new major version" security model), and a version of Rust used for everything else that follows the distribution security model (maintain the same major version, incorporate minimal security/bugfix patches).

Conill: The long-term consequences of maintainers’ actions

Posted Sep 17, 2021 20:07 UTC (Fri) by ariadne (subscriber, #138312) [Link] (1 responses)

In Alpine, we have two repositories that are included in each release branch. There is main, which has a minimum 2 year support lifecycle for all packages. There is also community, which has a minimum of 6 months, the cadence at which new branches get cut.

For volatile packages like firefox and chromium, we carry them in community, which means that desktop users are expected to follow the latest stable release branch.

At present, Firefox has begun to relax their requirements for a supported rust compiler, as the features they need begin to land. I suspect that Firefox will wind up supporting the ferrocene compilers once they are released, but that’s just speculation.

So really, the convergence of an LTS lifecycle for rust and downstream software supporting it, is near. We just have to be a little more patient.

Conill: The long-term consequences of maintainers’ actions

Posted Sep 17, 2021 20:23 UTC (Fri) by josh (subscriber, #17465) [Link]

Would it make sense to have a current version of Rust in community for use by firefox, and a frozen version of Rust in main for use by packages in main?