[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Proposal for how to deal with Go/Rust/etc security bugs (was: Re: Limited security support for Go/Rust? Re ssh3)



On 2024-01-24 13:26:49 +0100 (+0100), Johannes Schauer Marin Rodrigues wrote:
[...]
> how does that work for those applications that require rust, go
> and friends? Are you proposing that everything that needs them
> should be be distributed by a flatpak or similar mechanism
> instead?
> 
> Just a few days ago I tried building mesa from experimental
> (otherwise there are severe graphics glitches on my platform) on
> bookworm and everything worked except its rust build dependencies.
> I had no luck trying to backport those parts of rust that I needed
> and even if it had worked, it would've meant backporting dozens of
> rust packages just to have a backport of mesa.
[...]

Another practical example is Python applications/libs increasingly
integrating performance or security critical routines (re)written in
Rust. The python-cryptography source package in sid build-depends on
cargo and a dozen Rust libs. I didn't bother to pull a rdeps list
for it, but can guarantee a vast swath of the python3-* packages in
Debian depend on python3-cryptography, and this particular problem
will only get worse as the CPython core devs see the rising
popularity of the externally-developed cryptography library as a
good reason to strip any remnants of cryptographic modules and
bindings from the stdlib.
-- 
Jeremy Stanley

Attachment: signature.asc
Description: PGP signature


Reply to: