The audit of the lock against Debian's archive (qa.debian.org
madison, sid/trixie/bookworm) showed 255 of 291 crates packaged, the
36 missing ones all Windows/wasm/apple/redox-only. Making the tree
build against the Debian-packaged crates — the difference between a
vendored source package and a thin debcargo one — needed:
- sha1/sha2/md-5 bumped to the digest 0.11 line (sid moved, 0.10 is
trixie-only): finalize() now returns hybrid-array Output without
LowerHex (hex::encode it) and no io::Write impl (sha256_file reads
chunks into update()). The digest outputs are unchanged; the full
suite including the checksums tests passes.
- crossterm 0.28 -> 0.29: Debian skipped 0.28 entirely.
- reqwest 0.12 -> 0.13: the blocking/json/stream usages carried over
unchanged.
- suppaftp behind an opt-out 'ftp' feature: the one dependency absent
from the archive, used only by the plain-FTP upload fallback of
'pkh put' — the Debian build drops it and the SFTP failure path
reports the transport as unavailable instead.
- every patch-level requirement pin relaxed to the minor level
(4.5.51 -> 4.5, 1.0.228 -> 1.0, ...) — semver-compatible, and what
lets trixie's slightly older crates satisfy the manifest.
Result: 30 of 32 direct dependencies resolve from sid as-is; the
remaining two are indicatif 0.18 (sitting in experimental, migrating)
and the feature-gated suppaftp. No vendoring on sid.
The release-candidate version lands in 'pkh --version' and in the
build records' manifests, so an RC-tested tree is distinguishable
from the final release.
The runtime (multi-thread, for Runtime::new + block_on and task
spawning), time (retries, timeouts), sync (channels) and macros
(#[tokio::test]) cover every tokio:: path in the tree; 'full' also
pulled fs, io, net and process support nothing uses. Cargo.lock loses
the corresponding mio/signal deps if nothing else needs them.
Decode-only pure-Rust bzip2, matching flate2's pure-Rust default: no
new system packages for building pkh, and the archive-side origin of
the need is the busybox class of '.tar.bz2' upstream tarballs.
Publishing to crates.io requires a description and a license; the
repository and readme give the crates.io page the right links. The
license texts ship as LICENSE-MIT and LICENSE-GPL.
Dual licensing is valid while no lintian-derived code is in tree:
shelling out to lintian is mere aggregation. When derived lint
collections are implemented they must land in a separate GPL-2-only
crate, since their copyright belongs to lintian's authors and
cannot carry an MIT grant; the core crate stays dual.
suppaftp 12 is the FTP client behind the put FTP fallback transport:
the maintained continuation of rust-ftp (4.2M downloads, releases this
month), used with its default features only — a plain blocking FTP
stream, no TLS, no async. It brings just lazy-regex into the tree;
chrono is shared.
parking_lot replaces std sync mutex unwrapping in test code, per the
project rule.
Overflowing log lines in the pkh deb / pkh build rolling pane used to
wrap onto a second line, corrupting the pane layout. Truncate them to
the terminal width (minus the pane prefix) by display width and append
an ellipsis instead; lines are left whole when the terminal size is
unknown.
Replace the 'dpkg-buildpackage -S' wrapper with a native pipeline in
src/build/:
- deb822 control parser/writer with dpkg-compatible multiline rendering
(control.rs)
- md5/sha1/sha256 checksum registry, insertion-ordered like dpkg's
artifact accumulation (checksums.rs)
- Debian version splitting/validation and full changelog entry parsing,
including binNMU binary-only entries (metadata.rs)
- build-type bitflags and rules-target/artifact-suffix mapping
(buildtype.rs)
- environment setup: SOURCE_DATE_EPOCH, DEB_BUILD_OPTIONS,
dpkg-architecture env dump, vendor default profiles and the sanitized
Environment field recorded in .buildinfo (env.rs)
- debian/files registry with atomic saves (files.rs)
- native .buildinfo writer, including the Installed-Build-Depends
closure computed over the dpkg status database (buildinfo.rs)
- native .changes writer emitting dpkg's canonical field order with
legacy Files + Checksums-Sha1/Sha256 (changes.rs)
- gpgme clearsigning with the transitive checksum cascade
(dsc -> buildinfo -> changes), key discovery from the changelog
maintainer and UNRELEASED no-sign handling (sign.rs)
dpkg-source (-b/--before-build/--after-build) intentionally remains a
subprocess; debian/rules execution is unchanged.
Validated differentially against real dpkg-buildpackage -S -I -i -nc -d
on native and 3.0 (quilt) fixture packages: .dsc byte-identical, .changes
payload matches modulo machine-dependent Installed-Build-Depends and
Environment content, all signatures verify with gpg, artifact ordering
and UNRELEASED no-sign behavior match dpkg.
The Ubuntu development series (stonking) Sources.gz no longer ships a
Checksums-Sha256 field, only Checksums-Sha512 and the legacy Files
(MD5) field. The package_info parser only read Checksums-Sha256, so
the file list ended up empty and fetch_orig_tarball panicked on
Option::unwrap() when looking for the orig tarball.
- Add a ChecksumAlgo enum (Md5/Sha256/Sha512) to FileEntry, replacing
the hardcoded sha256 field, and parse the strongest available
checksum field (Sha256 > Sha512 > MD5).
- Make download_file_checksum verify against the correct algorithm
instead of always using SHA-256.
- Replace the unwrap() on the orig tarball search with a proper error
listing the available files, so future regressions fail clearly
instead of panicking.
- Add md-5 dependency for MD5 verification.
Multiple changes:
- New contexts (schroot, unshare)
- Cross-building quirks, with ephemeral contexts and repositories management
- Contexts with parents, global context manager, better lifetime handling
- Local building of binary packages
- Pull: pulling dsc files by default
- Many small bugfixes and changes
Co-authored-by: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Co-committed-by: Valentin Haudiquet <valentin.haudiquet@canonical.com>
vhaudiquet