Re: [Buildroot] [PATCH 14/16] package/pkg-cargo: add support for unlocked packages

["Yann E. MORIN" <yann.morin.1998@free.fr>]

James, All,

On 2024-06-02 15:25 -0600, James Hilliard spake thusly:
> On Sun, Jun 2, 2024 at 3:15 PM Yann E. MORIN <yann.morin.1998@free.fr> wrote:
> > On 2024-06-02 14:53 -0600, James Hilliard spake thusly:
> > > On Sun, Jun 2, 2024 at 2:42 PM Yann E. MORIN <yann.morin.1998@free.fr> wrote:
[--SNIP--]
> > > > +When a package source tree contains a +Cargo.lock+ file, the package has
> > > > +been _locked_: cargo did store the versions for the complete dependency
> > > > +chain in the +Cargo.lock+ file; that is then reused by cargo during the
> > > > +vendoring, which yields a reproducible dependency chain, and thus a
> > > > +reproducible tarball; therefore, it is possible to compute a hash for
> > > > +that archive. If a package was however not locked, then the versions for
> > > > +the dependencies are unknown, the dependency chain is not reproducible,
> > > > +and the archive is then not reproducible, which implies there can be no
> > > > +hash for that archive.
> > > Hmm, for these cases shouldn't we generate and commit the lockfile to
> > > the buildroot package so that we can then generate a deterministic archive
> > > and archive hash?
[--SNIP--]
> Yeah, something along those lines, one thing that might be a bit tricky is
> that we probably need to incorporate the Cargo.lock file hash or something
> like that in the archive name, so that way if the Cargo.lock file needs to be
> regenerated the archive name will also be appropriately changed at the same
> time.

Hmmm... Indeed, this would cause quite some grief if we would change the
Cargo.lock...

However, I don't see an easy solution to this issue... :-/

Well, I do have an idea, and it would definitely work, but it would be
*excessively* ugly... I'll try to implement it, but as an additional
change on-top of the existing series, because I am not sure it would br
meaningful in the end... Let's see...

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot