Bug 905705

Summary:	dev-lang/rust-1.69.0-r1 - libssh2-sys crate has a vendored copy of net-libs/libssh2
Product:	Gentoo Linux	Reporter:	orbea <orbea>
Component:	Current packages	Assignee:	Gentoo Rust Project <rust>
Status:	CONFIRMED ---
Severity:	normal	CC:	esigra, gentoo, navi, randy, rust
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/gentoo/gentoo/pull/30861
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	251464

Description orbea 2023-05-04 15:39:17 UTC

Currently dev-lang/rust has a vendored libssh2-sys crate which itself has a vendored copy of the C libssh2. This can be problematic when the rust upstream rarely updates the crate (Or the vendored C library) to a current version and Gentoo may end up with having to patch the same bug in multiple places which is especially annoying how rust tracks the sha256sums of every file provided by the crate in a single giant one liner and will error if they mismatch (Even though its possible and easy to just edit the sum).

Using the system version can be done by exporting 'LIBSSH2_SYS_USE_PKG_CONFIG=1', but perhaps this might introduce unintended consequences if/when libssh2 changes ABI and the system-bootstrap may not work? OpenBSD seems to have been using a system version since 2018 when they updated to rust-1.29 so maybe its not a serious concern?

Personally I strongly prefer system libraries, but this should be investigated to see why this may be a good idea or not.