From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: Failure to build clamav due to rust reversion Date: Fri, 30 Aug 2024 17:39:18 +0200 Message-ID: In-Reply-To: <074bd2c0-db51-4ea9-99d7-8b7db5580ae7@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8035743017515242755==" List-Id: --===============8035743017515242755== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello, Just to add more to this chaos: https://www.phoronix.com/news/Debian-Orphans-Bcachefs-Tools It seems that it is literally becoming impossible to package Rust software. F= irefox builds with exactly one version of the Rust compiler; packages have to= ns of very specific dependencies that need to be available in the exact versi= on as defined in Cargo.lock. Obviously we struggle to package all of that as = it is a lot of work, pretty much pointless and what not=E2=80=A6 I am angry with this because this is not necessarily a problem of the languag= e itself, but rather the eco system that was built around it. Clamav 1.3.0 is technically EOL and won=E2=80=99t be patched for any security= problems, so I suppose this problem won=E2=80=99t go away easily for us. -Michael > On 30 Aug 2024, at 10:37, Matthias Fischer = wrote: >=20 > On 29.08.2024 23:17, Adolf Belka wrote: >> Hi Matthias, >=20 > Hi Adolf, >=20 >> On 29/08/2024 19:18, Matthias Fischer wrote: >>> On 29.08.2024 15:24, Adolf Belka wrote: >>>> Hi All, >>>=20 >>> Hi, >>>=20 >>>> On 29/08/2024 15:04, Adolf Belka wrote: >>>>> Hi Michael & Matthias, >>>>>=20 >>>>> I just re-ran my build after the removal of the coreutils patch. >>>>>=20 >>>>> The build went past coreutils with no problem. However it has then fail= ed at clamav (1.4.0) with the message >=20 >>>>> ... >=20 > [some stuff shortened] >=20 >>>> Looking through clamav, I can't find a way to easily tell clamav to use = the rust-home version that is in IPFire. Hopefully Matthias with his knowledg= e of building clamav with rust can find a way. >>>=20 >>> Sorry Adolf, but I fear, I'm not *that* experienced... ;-) >>=20 >> I had a look through and found the rust source from 1.65.0 and I created a= patch to change the home directory contents in the clamav source tarball to = the version of home-0.5.3 instead of 0.5.5 which requires a min rust of 0.70.= 1 or similar. >=20 > First attempt... >=20 >> That resulted in the next fail where the rust-which package was asking for= a minimum home version of 0.5.5 >=20 > Next failure... >=20 >> So then I created another patch to modify the rust-which version requireme= nt for home to 0.5.3 >=20 > Oh my... >=20 >> Then the build failed again with a message that home has to be > 0.5.3 and= that is locked to version 0.5.9 but I can't find where that requirement is s= pecified and I have the feeling this will become like going down the rabbit h= ole in Alice in Wonderland, so I am giving up at this point. >=20 > Could that be 'Cargo.lock' (line 465ff) or 'Cargo.toml' (line 12ff)? >=20 > But: WOW! You have my fullest sympathy and respect! But this was what I > expected - and I still think its not worth it, the efforts and work are > too extensive. >=20 >> There were no CVE fixes in clamav-1.4.0 so I think we can just wait for ru= st to be updated. >=20 > FULL ACK! >=20 > Best > Matthias >=20 >> Regards, >>=20 >> Adolf. >>=20 >>>=20 >>> I wouldn't want to temper with this and revert 'clamav', too. >>>=20 >>> Best >>> Matthias >>>=20 >>>> Regards, >>>>=20 >>>> Adolf. >>>>=20 >>>>> Regards, >>>>>=20 >>>>> Adolf. --===============8035743017515242755==--