[FFe] rustc: Downgrade cargo from Recommends to Suggests

Bug #1966200 reported by Simon Chopin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rustc (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Hi,

I'd like to upload a new rustc version (see attached debdiff). In addition to the obvious security fix, this version would downgrade the Recommends: cargo to a mere Suggests: for the rustc binary.

The rationale behind the change is that we'd like to promote rustc to main (see https://bugs.launchpad.net/ubuntu/+source/rustc/+bug/1957932 for details) and cargo isn't ready to be promoted.

I expect the impact on the archive to be minimal, as there are only two direct reverse-dependencies on rustc:

❯ reverse-depends rustc
Reverse-Depends
* cargo
* rust-all

rust-all already has its own Depends: relationship to cargo, and as such isn't relying on rustc to provide it.

AFAIK our builders don't consider Recommends dependencies, so this change shouldn't result in build breakages.

My educated guess is that any user that wishes to install Rust and does *not* follow that community's standard way of doing things (bypassing system packages) would install rust-all or cargo directly, not expecting rustc to provide the higher-level tooling.

CVE References

Revision history for this message
Simon Chopin (schopin) wrote :
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

I can't think of any big issues this could introduce. I don't have a strong feeling about this (although I am not a rust user), but if it makes the MIR of rustc easier, feels like something that should be considered. Okay, please proceed. Can you link to this bug in the changelog entry for the Recommends -> Suggest change?

Changed in rustc (Ubuntu):
status: New → Triaged
Revision history for this message
Simon Chopin (schopin) wrote :

Uploaded with amended changelog. Thanks for the review!

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rustc - 1.58.1+dfsg1~ubuntu1-0ubuntu2

---------------
rustc (1.58.1+dfsg1~ubuntu1-0ubuntu2) jammy; urgency=medium

  * d/p/ubuntu-fix-crossbeam-CVE-2022-23639.patch: amended to also patch the
    0.7.2 version of the crate
  * Downgrade cargo from rustc Recommends to Suggests to make rustc promotable to
    main. (LP: #1966200)

 -- Simon Chopin <email address hidden> Fri, 01 Apr 2022 11:54:57 +0200

Changed in rustc (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.