From: Matt Jolly <
kangie@gentoo.org>
Updating vulnerable (or otherwise outdated) crates in Rust ebuilds
is painful. Generally speaking, there are 5 options:
- Run `cargo update` to fetch new versions from the web.
This is obviously not suitable for use in Portage.
- Patch the software via Portage to accept a non-vulnerable crate.
This is a reasonable option when the package is not too complex
but still requires significant developer effort and some familiarity
with Cargo. In the case of complex patches this may not be feasible,
or require the generation of a dependency tarball.
- [patch] the source (repository) in Cargo.toml. This enables the
targeting of specific crates, but does not allow the replacement
of only a specific version in the depgraph.
- [replace] a particular crate:version in the Cargo.toml. This
enables the targeting of a particular version with an arbitrary
path however the replacement crate must *have the same version*
as the one being overridden.
- `paths = [...]` overrides: pass an array of paths to directories that
contain a Cargo.toml. Cargo will override any crate with the same package name
arbitrarily, ignoring the lock file and versions; typically used for testing.
Is applied via ${CARGO_HOME}/config.toml (i.e. globally)
This commit:
- Implements the `paths` overrides, which will work even when
Cargo is configured to use a vendored directory. This is not a 'smart'
replacement and care must be taken to ensure that all versions of
the crate in use are compatible (`cargo tree` will help).
- Provides a helper which runs `cargo --update --offline` against
${ECARGO_VENDOR} (where ${CRATES} are unpacked). This enables the
replacement of vulnerable versions in ${CRATES}. It is up to the
consumer to ensure that only the desired crates are being replaced
and that package behaviour does not change.
- Adds a new `CARGO_BOOTSTRAP` variable which enables packages to
ignore the minimum version requirement of the eclass. This is only
used for bootstrapping Rust; if it's being used in any non
dev-lang/rust ebuilds be sure that you have a good reason.
Resources:
-
https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html
-
https://github.com/rust-lang/cargo/issues/3308
Signed-off-by: Matt Jolly <
kangie@gentoo.org>
---
eclass/cargo.eclass | 115 +++++++++++++++++++++++++++++++++++++++++---
1 file changed, 109 insertions(+), 6 deletions(-)
diff --git a/eclass/cargo.eclass b/eclass/cargo.eclass
index 95ff317e1f21..a49ef818a351 100644
--- a/eclass/cargo.eclass
+++ b/eclass/cargo.eclass
@@ -7,6 +7,7 @@
# @AUTHOR:
# Doug Goldstein <
cardoe@gentoo.org>
# Georgy Yakovlev <
gyakovlev@gentoo.org>
+# Matt Jolly <
kangie@gentoo.org>
# @SUPPORTED_EAPIS: 8
# @PROVIDES: rust
# @BLURB: common functions and variables for cargo builds
@@ -37,8 +38,10 @@ case ${EAPI} in
if [[ -n ${RUST_MIN_VER} ]]; then
# This is _very_ unlikely given that we leverage the rust eclass but just in case cargo requires a newer version
# than the oldest in-tree in future.
- if ver_test "${RUST_MIN_VER}" -lt "${_CARGO_ECLASS_RUST_MIN_VER}"; then
- die "RUST_MIN_VERSION must be at least ${_CARGO_ECLASS_RUST_MIN_VER}"
+ if [[ -z ${CARGO_BOOTSTRAP} ]]; then
+ if ver_test "${RUST_MIN_VER}" -lt "${_CARGO_ECLASS_RUST_