Bug#1083025: RFP: lldap -- Light LDAP implementation for authentication

[Antoine Beaupré <anarcat@debian.org>]

On 2024-09-30 10:23:12, Alexandre Rossi wrote:

[...]

> This should probably be maintained within the Debian Rust Packaging team.

So I'm not on the rust team, but I'm interested in using this, so I took
a look.

First off, cargo debstatus doesn't work from the top-level (at least in
trixie), you need to be in the server directory. And then, oooh boy, is
that a ride. I think it's the longest output *i* have ever seen (but I
haven't seen much).

It starts like this:

 🔴 lldap v0.6.2 (/home/anarcat/dist/lldap/server)
 🔴 ├── lldap_access_control v0.1.0 (/home/anarcat/dist/lldap/crates/access-control)
 🔴 │   ├── lldap_auth v0.6.0 (/home/anarcat/dist/lldap/crates/auth)
    │   │   ├── chrono v0.4.38 (in debian)
 ⌛ │   │   ├── curve25519-dalek v3.2.0 (outdated, 4.2.0+dfsg in debian)
    │   │   │   ├── byteorder v1.5.0 (in debian)
 ⌛ │   │   │   ├── digest v0.9.0 (outdated, 0.10.7 in debian)
    │   │   │   │   └── generic-array v0.14.7 (in debian)
 ⌛ │   │   │   ├── rand_core v0.5.1 (outdated, 0.6.4 in debian)
 ⌛ │   │   │   │   └── getrandom v0.1.16 (outdated, 0.2.15 in debian)
    │   │   │   │       ├── cfg-if v1.0.0 (in debian)
    │   │   │   │       └── libc v0.2.161 (in debian)
[...]

and goes on, and on, and deeper too.

There's 61667 lines of output there, that's sixty *thousand* transitive
dependencies. Of course, there's lots of duplicates in there, and lots
of it is already in Debian, but still, that's quite the tree. If we trim
out dev deps, it's a little better:

anarcat@angela:~/d/l/server> cargo debstatus --no-dev-dependencies | wc -l
25365

and, of course, if we just remove the tree altogether, we get something
a little saner:

> cargo debstatus --no-indent | sort -u | wc -l 
242

that is, 242 direct deps. Out of that, about 50 are missing entirely
from Debian:

> cargo debstatus --no-indent | grep 🔴 | sed 's/ v.*//' | sort -u| wc -l
48

... and 13 from lldap itself:

anarcat@angela:~/d/l/server> cargo debstatus --no-indent | grep 🔴 | sed 's/ v.*//' | sort -u| grep lldap | wc -l 
13

So in any case, this is going to be a challenge, to say the least.

Some things, like graphql_client, jwt, email-encoding, ldap3 and so on
will likely be useful for other packages as well, of course, but it's
still a lot of stuff to package.

a.

-- 
Never underestimate the bandwidth of a station wagon full of tapes
hurtling down the highway.
                        - Andrew S. Tanenbaum, "Computer Networks"