From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4dyDkc6vF7z30Kj for ; Fri, 23 Jan 2026 10:31:52 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4dyDkY2YpXz2xJy for ; Fri, 23 Jan 2026 10:31:49 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4dyDkX07P4z2X3; Fri, 23 Jan 2026 10:31:47 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1769164308; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zKhOD77K8RqRvzn9LTIHAIuH7fUI5nJG0UiE2w1L8GA=; b=ZwjTRqkTZyT8xN/RGY3/dbrs9RRUID5WRvn8v17+U5aDIJi89To3SYOZz8jujd+MOmJDIp NU12AfPWR6PzTiCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1769164308; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zKhOD77K8RqRvzn9LTIHAIuH7fUI5nJG0UiE2w1L8GA=; b=jZkUXSRmGtInH7I6wgf6ddzuZe68Uqf/h2TKQe8fJsFHc8JSBGvBKLtLF0d+nW0qX3qWjt ZKWBpiw9v6sa9o79eqLdS/NGduNkit+ct23R1m0sFjZR6DPlr8/aDHg45P8LmQryh0MViO oq6B/qK7hiH05t0fZB9lrqP6UjeE/UFJqecko0AAGvG9368cC9NV+wh7X839/jBQKwyZe4 XHwt+TznIy1MGjOweeCji45lpY19ltr3PuzyuwqFmPWpw7L7QC6Qcbzex8jX+87wPnFAoQ IMw3kEMBwPPtTtKpq6AzBa3BTrdY/wth6iVi/ftVWbVzu3kkAQ5YgTUI/waYaA== Content-Type: text/plain; charset=us-ascii Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: Updating rust and eco system From: Michael Tremer In-Reply-To: Date: Fri, 23 Jan 2026 10:31:47 +0000 Cc: development@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: <02AF1D50-1E51-48DE-A5EE-D89C89B3B34E@ipfire.org> References: To: Stefan Schantl Hello Stefan, Hello list, Thank you for looking at this. Of course it is very important that we = are able to stay on the latest version of Suricata. I have merged your monster of a patch so that we can move on for now, = but I have a couple of bigger questions that we all should have a look = at: Adolf has in the past spent a lot of time on updating Rust. This is all = tapping into Python - or rather python-cryptography - having some Rust = code that has further dependencies. In essence, it has been a huge = headache to update this. Maybe Adolf even has some other words for this = all. Just building cbindgen has required a further ~98 Rust crates to be = packaged. Often we have the same crate in different versions because = other crates have pinned a specific version. In total, we currently have = ~790 packages in IPFire. Out of those, there are 202 packages in the = rust-* namespace. That is pretty much a quarter of the distribution. = Although not a lot in size, this is a considerable maintenance burden. ClamAV and Suricata have (recently?) started to bundle all their Rust = dependencies with their release tarballs. Although this is not a good = thing for many other reasons, it will move the onus onto the upstream = projects to provide whatever they need. If their dependencies (and the = dependencies of their dependencies) explode, this is not really our = problem any more as well as any supply chain problems. Great - within = reason. That leaves us with only very few packages that would actually require = any external Rust crates (Suricata is even configured to *exclusively* = use their bundled crates): cbindgen as a new thing, python-cryptography, = anything else? We might actually only need a fraction of the Rust crates = that we currently have as the only packages that may actually tap into = our locally built repository are only those two. Is anyone happy to give this all a try and cleanup any old Rust deps? = That way, I hope we will have a much smoother ride moving forward with a = Python update. All the best, -Michael > On 22 Jan 2026, at 17:38, Stefan Schantl = wrote: >=20 > Hello list followers, >=20 > I'm currently updating rust and affected modules. >=20 > This happends mainly because I'm trying to fix the "suricata cache > grows infinite" problem, which a lot of people are affected. >=20 > To archive this, I ported the patches from suricata main development > branch to our used suricata version (8.0.3). >=20 > To perform a full build, a new tool called cbindgen - which is a rust > to c bindings generator, is required. >=20 > Sadly this tool is also written in rust and requires some new > dependencies and a more up to date rust compiler. >=20 > I hope to send a patchset for all this very soon to the mailing list. >=20 > Best regards, >=20 > -Stefan=20 >=20 >=20