From Newsgroup: alt.os.linux.debian

[This is a copy of my response to 20251031213541.GA73786@debian.org
that was accepted by bendel.debian.org 2025-11-05 18:30 UTC,
but so far didn't show up in the mailing lists. Perhaps it's
stuck in the moderation queue, or perhaps it was silently
discarded, as does occasionally happen. Either way, I post
it here as well in case it might be of interest to anyone.]

On 2025-10-31, Julian Andres Klode wrote:

In particular, our code to parse .deb, .ar, .tar, and the HTTP
signature verification code would strongly benefit from memory safe languages and a stronger approach to unit testing.

If you maintain a port without a working Rust toolchain, please
ensure it has one within the next 6 months, or sunset the port.

It's important for the project as whole to be able to move forward
and rely on modern tools and technologies and not be held back by
trying to shoehorn modern software on retro computing devices.

From where I stand, it's important for the project to stay true
to its principles. I took time to carefully re-read [1], and
what I do /not/ find there is something to the effect that "our
priorities are memory safe languages and modern technologies."
The document is no longer pointed to from http://debian.org/ ,
granted, so perhaps it's not as important for Debian as it used
to be. In which case take this remark with a grain of salt.

[1] http://debian.org/social_contract

(The essence of this has already been stated elsewhere in the
thread, but I figure I'd rather speak up now, than regret
"when they came for the hppa port..." later.)

Now, more to the point. Over the past decade or so, I've
been effectively maintaining my own private Debian derivative
to use on machines that are either my own, or for which I'm
otherwise responsible. In case Rust becomes a "hard requirement"
for APT, I'll start maintaining a fork without such requirement.

By necessity, it will be a minimalist fork; something that
figures dependencies, downloads packages, and calls dpkg
on them. Something that I can maintain 'while my boss
isn't looking,' so to say. I will be updating it to remain
interoperable with Debian repositories, and to run on as many
of platforms as I can reach, but otherwise will very much
prefer it in feature-frozen, "learn once, use forever" state.

No idea if it would be of much help to the maintainers of the
ports at risk, but either way, I'm willing to share.
--- Synchronet 3.21a-Linux NewsLink 1.2