Rust, RPMs, and the Fine Art of Dependency Bundling

Managing Rust dependencies in linux distributions packaging often involves navigating a tangled web of missing packages, mismatched versions, and the need to patch vendored crates manually. In this talk, we’ll explore a solution to simplify this process in RPM based distros by enhancing the rust2rpm tool to automate the patching and repackaging of vendored dependencies.

Even though the main approach is to have every dependency packaged, it often becomes really difficult to achieve that goal as you may find yourself out in a dependency hell situation where you'll have to deal with an outstanding number of them. Even if its a compromise you can bundle dependencies, but that comes with some drawbacks.

When packaging, you may often find yourself in a situation where you'll have to patch rpm's on the fly to fix out issues, but that's not really doable when you're working with bundled dependencies.

We'll discuss about introducing a new -p flag in rust2rpm, which enables users to easily apply patches to vendored crates (like fiat-crypto), modify dependencies, and repackage them without the need for manual steps.

We’ll also discuss a more flexible approach using a new helper tool, rust2rpm-vendor, that allows maintainers to prepare and patch vendor tarballs independently, automating the entire workflow from patch application to repacking.

This talk will show how these enhancements can help alleviate "dependency hell" in Fedora’s Rust ecosystem, making it easier for maintainers to handle vendored crates and improve the overall Rust packaging experience.

Links - rust2rpm on Pagure