Failure to build clamav due to rust reversion

Failure to build clamav due to rust reversion

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]

Hi Michael & Matthias,

I just re-ran my build after the removal of the coreutils patch.

The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message

error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
Either upgrade to rustc 1.70.0 or newer, or use
cargo update -p home(a)0.5.9 --precise ver
where `ver` is the latest version of `home` supporting rustc 1.67.0

Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.

https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9

So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0

Unless of course I have not understood the root cause of this problem, which definitely could be the case.

Regards,

Adolf.

Re: Failure to build clamav due to rust reversion

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 1473 bytes --]

Hi All,

On 29/08/2024 15:04, Adolf Belka wrote:
> Hi Michael & Matthias,
>
> I just re-ran my build after the removal of the coreutils patch.
>
> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
>
> error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
> Either upgrade to rustc 1.70.0 or newer, or use
> cargo update -p home(a)0.5.9 --precise ver
> where `ver` is the latest version of `home` supporting rustc 1.67.0
>
> Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.
>
> https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9
>
> So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0
>
> Unless of course I have not understood the root cause of this problem, which definitely could be the case.
>
I have realised that clamav has the rust modules bundled into the source tarball and home is at 0.5.9 in that bundle.

Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.

Regards,

Adolf.

> Regards,
>
> Adolf.
>

Re: Failure to build clamav due to rust reversion

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 2065 bytes --]

Okay, Rust is such a nightmare…

I didn’t run a full clean build after the revert because my build system is busy with other things… I just assumed it would be working fine.

I can revert clamav as well for now until we have a solution so that at least the system can finish the build.

I would like to leave this for you to find a solution as you are way more involved in this than I am. If you need me, you know where to find me.

-Michael

> On 29 Aug 2024, at 15:24, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
> 
> Hi All,
> 
> On 29/08/2024 15:04, Adolf Belka wrote:
>> Hi Michael & Matthias,
>> 
>> I just re-ran my build after the removal of the coreutils patch.
>> 
>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
>> 
>> error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
>> Either upgrade to rustc 1.70.0 or newer, or use
>> cargo update -p home(a)0.5.9 --precise ver
>> where `ver` is the latest version of `home` supporting rustc 1.67.0
>> 
>> Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.
>> 
>> https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9
>> 
>> So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0
>> 
>> Unless of course I have not understood the root cause of this problem, which definitely could be the case.
>> 
> I have realised that clamav has the rust modules bundled into the source tarball and home is at 0.5.9 in that bundle.
> 
> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.
> 
> Regards,
> 
> Adolf.
> 
>> Regards,
>> 
>> Adolf.

Re: Failure to build clamav due to rust reversion

[Matthias Fischer]

[-- Attachment #1: Type: text/plain, Size: 1769 bytes --]

On 29.08.2024 15:24, Adolf Belka wrote:
> Hi All,

Hi,

> On 29/08/2024 15:04, Adolf Belka wrote:
>> Hi Michael & Matthias,
>>
>> I just re-ran my build after the removal of the coreutils patch.
>>
>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
>>
>> error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
>> Either upgrade to rustc 1.70.0 or newer, or use
>> cargo update -p home(a)0.5.9 --precise ver
>> where `ver` is the latest version of `home` supporting rustc 1.67.0
>>
>> Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.

Ok, then it seems that 'clamav 1.4.0' is out for now, too.

>> https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9
>>
>> So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0
>>
>> Unless of course I have not understood the root cause of this problem, which definitely could be the case.
>>
> I have realised that clamav has the rust modules bundled into the source tarball and home is at 0.5.9 in that bundle.
> 
> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.

Sorry Adolf, but I fear, I'm not *that* experienced... ;-)

I wouldn't want to temper with this and revert 'clamav', too.

Best
Matthias

> Regards,
> 
> Adolf.
> 
>> Regards,
>>
>> Adolf.
>>

Re: Failure to build clamav due to rust reversion

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 2634 bytes --]

Hi Michael,

I just found this section on the rust site that suggests a build from source can be done, if my interpretation is correct.

https://forge.rust-lang.org/infra/other-installation-methods.html#source-code

If this is really being able to build the rust toolchain from scratch via a source build then I could give that a try.

What are the changes that you mentioned needed to be made to make rust build ruby for non x86_64 architectures?

Regards,

Adolf.

On 29/08/2024 15:55, Michael Tremer wrote:
> Okay, Rust is such a nightmare…
> 
> I didn’t run a full clean build after the revert because my build system is busy with other things… I just assumed it would be working fine.
> 
> I can revert clamav as well for now until we have a solution so that at least the system can finish the build.
> 
> I would like to leave this for you to find a solution as you are way more involved in this than I am. If you need me, you know where to find me.
> 
> -Michael
> 
>> On 29 Aug 2024, at 15:24, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
>>
>> Hi All,
>>
>> On 29/08/2024 15:04, Adolf Belka wrote:
>>> Hi Michael & Matthias,
>>>
>>> I just re-ran my build after the removal of the coreutils patch.
>>>
>>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
>>>
>>> error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
>>> Either upgrade to rustc 1.70.0 or newer, or use
>>> cargo update -p home(a)0.5.9 --precise ver
>>> where `ver` is the latest version of `home` supporting rustc 1.67.0
>>>
>>> Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.
>>>
>>> https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9
>>>
>>> So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0
>>>
>>> Unless of course I have not understood the root cause of this problem, which definitely could be the case.
>>>
>> I have realised that clamav has the rust modules bundled into the source tarball and home is at 0.5.9 in that bundle.
>>
>> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.
>>
>> Regards,
>>
>> Adolf.
>>
>>> Regards,
>>>
>>> Adolf.
> 
> 

Re: Failure to build clamav due to rust reversion

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 2808 bytes --]

Hi Matthias,

On 29/08/2024 19:18, Matthias Fischer wrote:
> On 29.08.2024 15:24, Adolf Belka wrote:
>> Hi All,
> 
> Hi,
> 
>> On 29/08/2024 15:04, Adolf Belka wrote:
>>> Hi Michael & Matthias,
>>>
>>> I just re-ran my build after the removal of the coreutils patch.
>>>
>>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
>>>
>>> error: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.67.0
>>> Either upgrade to rustc 1.70.0 or newer, or use
>>> cargo update -p home(a)0.5.9 --precise ver
>>> where `ver` is the latest version of `home` supporting rustc 1.67.0
>>>
>>> Rust was reverted back to 1.67.0 due to problems with building ruby for aarch64 and riscv64.
> 
> Ok, then it seems that 'clamav 1.4.0' is out for now, too.
I think that is the safest thing in the short term.
> 
>>> https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=33ee3958de834f7eb686fb5b5daa56d511bb18e9
>>>
>>> So until rust has the fix for building ruby for aarch64 and riscv64 then it looks like there needs to be a limit set to the version of rust-home to 0.5.3, which is the version that we have with rust-1.67.0
>>>
>>> Unless of course I have not understood the root cause of this problem, which definitely could be the case.
>>>
>> I have realised that clamav has the rust modules bundled into the source tarball and home is at 0.5.9 in that bundle.
>>
>> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.
> 
> Sorry Adolf, but I fear, I'm not *that* experienced... ;-)

I had a look through and found the rust source from 1.65.0 and I created a patch to change the home directory contents in the clamav source tarball to the version of home-0.5.3 instead of 0.5.5 which requires a min rust of 0.70.1 or similar.

That resulted in the next fail where the rust-which package was asking for a minimum home version of 0.5.5

So then I created another patch to modify the rust-which version requirement for home to 0.5.3

Then the build failed again with a message that home has to be > 0.5.3 and that is locked to version 0.5.9 but I can't find where that requirement is specified and I have the feeling this will become like going down the rabbit hole in Alice in Wonderland, so I am giving up at this point.

There were no CVE fixes in clamav-1.4.0 so I think we can just wait for rust to be updated.

Regards,

Adolf.

> 
> I wouldn't want to temper with this and revert 'clamav', too.
> 
> Best
> Matthias
> 
>> Regards,
>>
>> Adolf.
>>
>>> Regards,
>>>
>>> Adolf.
>>>
> 

Re: Failure to build clamav due to rust reversion

[Matthias Fischer]

[-- Attachment #1: Type: text/plain, Size: 2164 bytes --]

On 29.08.2024 23:17, Adolf Belka wrote:
> Hi Matthias,

Hi Adolf,

> On 29/08/2024 19:18, Matthias Fischer wrote:
>> On 29.08.2024 15:24, Adolf Belka wrote:
>>> Hi All,
>> 
>> Hi,
>> 
>>> On 29/08/2024 15:04, Adolf Belka wrote:
>>>> Hi Michael & Matthias,
>>>>
>>>> I just re-ran my build after the removal of the coreutils patch.
>>>>
>>>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message

>>>> ...

[some stuff shortened]

>>> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.
>> 
>> Sorry Adolf, but I fear, I'm not *that* experienced... ;-)
> 
> I had a look through and found the rust source from 1.65.0 and I created a patch to change the home directory contents in the clamav source tarball to the version of home-0.5.3 instead of 0.5.5 which requires a min rust of 0.70.1 or similar.

First attempt...

> That resulted in the next fail where the rust-which package was asking for a minimum home version of 0.5.5

Next failure...

> So then I created another patch to modify the rust-which version requirement for home to 0.5.3

Oh my...

> Then the build failed again with a message that home has to be > 0.5.3 and that is locked to version 0.5.9 but I can't find where that requirement is specified and I have the feeling this will become like going down the rabbit hole in Alice in Wonderland, so I am giving up at this point.

Could that be 'Cargo.lock' (line 465ff) or 'Cargo.toml' (line 12ff)?

But: WOW! You have my fullest sympathy and respect! But this was what I
expected - and I still think its not worth it, the efforts and work are
too extensive.

> There were no CVE fixes in clamav-1.4.0 so I think we can just wait for rust to be updated.

FULL ACK!

Best
Matthias

> Regards,
> 
> Adolf.
> 
>> 
>> I wouldn't want to temper with this and revert 'clamav', too.
>> 
>> Best
>> Matthias
>> 
>>> Regards,
>>>
>>> Adolf.
>>>
>>>> Regards,
>>>>
>>>> Adolf.
>>>>
>> 

Re: Failure to build clamav due to rust reversion

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 3125 bytes --]

Hello,

Just to add more to this chaos:

  https://www.phoronix.com/news/Debian-Orphans-Bcachefs-Tools

It seems that it is literally becoming impossible to package Rust software. Firefox builds with exactly one version of the Rust compiler; packages have tons of very specific dependencies that need to be available in the exact version as defined in Cargo.lock. Obviously we struggle to package all of that as it is a lot of work, pretty much pointless and what not…

I am angry with this because this is not necessarily a problem of the language itself, but rather the eco system that was built around it.

Clamav 1.3.0 is technically EOL and won’t be patched for any security problems, so I suppose this problem won’t go away easily for us.

-Michael

> On 30 Aug 2024, at 10:37, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
> 
> On 29.08.2024 23:17, Adolf Belka wrote:
>> Hi Matthias,
> 
> Hi Adolf,
> 
>> On 29/08/2024 19:18, Matthias Fischer wrote:
>>> On 29.08.2024 15:24, Adolf Belka wrote:
>>>> Hi All,
>>> 
>>> Hi,
>>> 
>>>> On 29/08/2024 15:04, Adolf Belka wrote:
>>>>> Hi Michael & Matthias,
>>>>> 
>>>>> I just re-ran my build after the removal of the coreutils patch.
>>>>> 
>>>>> The build went past coreutils with no problem. However it has then failed at clamav (1.4.0) with the message
> 
>>>>> ...
> 
> [some stuff shortened]
> 
>>>> Looking through clamav, I can't find a way to easily tell clamav to use the rust-home version that is in IPFire. Hopefully Matthias with his knowledge of building clamav with rust can find a way.
>>> 
>>> Sorry Adolf, but I fear, I'm not *that* experienced... ;-)
>> 
>> I had a look through and found the rust source from 1.65.0 and I created a patch to change the home directory contents in the clamav source tarball to the version of home-0.5.3 instead of 0.5.5 which requires a min rust of 0.70.1 or similar.
> 
> First attempt...
> 
>> That resulted in the next fail where the rust-which package was asking for a minimum home version of 0.5.5
> 
> Next failure...
> 
>> So then I created another patch to modify the rust-which version requirement for home to 0.5.3
> 
> Oh my...
> 
>> Then the build failed again with a message that home has to be > 0.5.3 and that is locked to version 0.5.9 but I can't find where that requirement is specified and I have the feeling this will become like going down the rabbit hole in Alice in Wonderland, so I am giving up at this point.
> 
> Could that be 'Cargo.lock' (line 465ff) or 'Cargo.toml' (line 12ff)?
> 
> But: WOW! You have my fullest sympathy and respect! But this was what I
> expected - and I still think its not worth it, the efforts and work are
> too extensive.
> 
>> There were no CVE fixes in clamav-1.4.0 so I think we can just wait for rust to be updated.
> 
> FULL ACK!
> 
> Best
> Matthias
> 
>> Regards,
>> 
>> Adolf.
>> 
>>> 
>>> I wouldn't want to temper with this and revert 'clamav', too.
>>> 
>>> Best
>>> Matthias
>>> 
>>>> Regards,
>>>> 
>>>> Adolf.
>>>> 
>>>>> Regards,
>>>>> 
>>>>> Adolf.