Bug 905705

Summary:	dev-lang/rust-1.69.0-r1 - libssh2-sys crate has a vendored copy of net-libs/libssh2
Product:	Gentoo Linux	Reporter:	orbea <orbea>
Component:	Current packages	Assignee:	Gentoo Rust Project <rust>
Status:	CONFIRMED ---
Severity:	normal	CC:	esigra, gentoo, navi, randy, rust
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/gentoo/gentoo/pull/30861
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	251464

Description orbea 2023-05-04 15:39:17 UTC

Currently dev-lang/rust has a vendored libssh2-sys crate which itself has a vendored copy of the C libssh2. This can be problematic when the rust upstream rarely updates the crate (Or the vendored C library) to a current version and Gentoo may end up with having to patch the same bug in multiple places which is especially annoying how rust tracks the sha256sums of every file provided by the crate in a single giant one liner and will error if they mismatch (Even though its possible and easy to just edit the sum).

Using the system version can be done by exporting 'LIBSSH2_SYS_USE_PKG_CONFIG=1', but perhaps this might introduce unintended consequences if/when libssh2 changes ABI and the system-bootstrap may not work? OpenBSD seems to have been using a system version since 2018 when they updated to rust-1.29 so maybe its not a serious concern?

Personally I strongly prefer system libraries, but this should be investigated to see why this may be a good idea or not.

Comment 1 Arthur Zamarin archtester

2025-04-16 07:34:54 UTC

1.69.0 rust was dropped from tree

Comment 2 Sam James archtester

2025-04-16 08:18:27 UTC

libssh2-sys disappeared from rust's Cargo.lock in:

commit f795a150fe01b68bdd62503c39fbdc9ed04a5219
Author: Weihang Lo <me@weihanglo.tw>
Date:   Wed Mar 15 12:50:04 2023 +0000

    chore: allow `cargo` to have its own workspace

    This also

    * bumps cargo to the latest in rust-lang/cargo.
    * adds 0BSD to allowed list of licenses

    Co-authored-by: Scott Schafer <schaferjscott@gmail.com>
    Co-authored-by: Eric Huss <eric@huss.org>

but dev-lang/rust definitely still bundles libssh2.