| 23 Jun 2026 |
|  isabel changed their profile picture. | 19:51:27 |
| 24 Jun 2026 |
 whispers [& it/fae] | maybe security sensitive cargo fixes (as well as some misc changes) in a patch release scheduled for tuesday fwiw: https://rust-lang.zulipchat.com/#narrow/channel/241545-t-release/topic/libssh2.20backport.20for.20cargo.20release / https://rust-lang.zulipchat.com/#narrow/channel/241545-t-release/topic/1.2E96.2E1.20release/with/606283447 | 16:30:39 |
| whispers [& it/fae] | * | 16:31:06 |
| whispers [& it/fae] | * | 16:31:48 |
| whispers [& it/fae] | * | 16:32:05 |
| whispers [& it/fae] | * | 16:32:29 |
| 25 Jun 2026 |
 Alyssa Ross | Sounds like we could address the security issue immediately, while improving our packaging, by just making sure our Cargo isn't using a vendored libssh2. | 08:27:22 |
 Marie | seems like we use our own libssh2 | 08:29:58 |
| Marie | (and cargo still depends on rustc- and cargo-bootstrap :/) | 08:30:16 |
|  Sarah Clark joined the room. | 19:54:50 |
| Sarah Clark | I need help with a build error. I'm updating snouty from 0.5.0 to 0.6.1 and recieved:
> thread 'main' (8944) panicked at /build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2/build.rs:38:10:
> generating header: CargoMetadata("/build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2/Cargo.toml", Metadata(Output { status: ExitStatus(unix_wait_status(25856)), stdout: "", stderr: "error: failed to get `ciborium` as a dependency of package `hegeltest-c v0.21.2 (/build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2)`\n\nCaused by:\n failed to load source for dependency `ciborium`\n\nCaused by:\n unable to update registry `crates-io`\n\nCaused by:\n failed to update replaced source registry `crates-io`\n\nCaused by:\n failed to read root of directory source: /build/snouty-0.6.1-vendor/@vendor@/source-registry-0\n\nCaused by:\n No such file or directory (os error 2)\n" }))
| 19:56:39 |
| Sarah Clark | * I need help with a build error. I'm updating snouty from 0.5.0 to 0.6.1 and recieved:
thread 'main' (8944) panicked at /build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2/build.rs:38:10:
generating header: CargoMetadata("/build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2/Cargo.toml", Metadata(Output { status: ExitStatus(unix_wait_status(25856)), stdout: "", stderr: "error: failed to get ciborium as a dependency of package hegeltest-c v0.21.2 (/build/snouty-0.6.1-vendor/source-registry-0/hegeltest-c-0.21.2)\n\nCaused by:\n failed to load source for dependency ciborium\n\nCaused by:\n unable to update registry crates-io\n\nCaused by:\n failed to update replaced source registry crates-io\n\nCaused by:\n failed to read root of directory source: /build/snouty-0.6.1-vendor/@vendor@/source-registry-0\n\nCaused by:\n No such file or directory (os error 2)\n" }))
| 19:57:09 |
 Winter | blagh, I’ll grab. | 19:57:20 |
| Sarah Clark | Thank you | 19:57:35 |
| Winter | out of curiosity, was there some out of date list you were looking at or something | 19:58:21 |
| Sarah Clark | My partner is about to use it for work and I wanted to make sure it was current. | 20:00:29 |
| 27 Jun 2026 |
 Toma | I think you just need to rm "$cargoDepsCopy/.cargo/config.toml" in postPatch but I have not tried if it actually works or not.
I think that file should probably be removed by the setup hook itself, cuz it causes some crates to trip up. | 10:15:40 |
| Toma | nope, it still did not work, but I'll try to look into it | 10:26:55 |
| Toma | * nope, it still did not work, but I'll try to look into it
(though the error message is different) | 10:27:50 |
| Winter | it’s unfortunately a lot more annoying than that | 10:54:26 |
| Toma | yup, I've realised | 10:55:13 |
| Winter | pretty sure it’s a cbindgen thing: it doesn’t pass --no-deps to cargo metadata | 10:55:23 |
| Winter | i just haven’t gotten a chance to see if that’ll do it as i’d need to patch the build script and then run cbindgen manually | 10:56:02 |
| Winter | sorry for making you duplicate work :< | 10:56:52 |
| Winter | though maybe you’ll tell me my complicated solution is wrong 🙏 lol | 10:57:26 |
| Toma | np, I explicitly wanted to figure out these kinds of failures, but never had the time to look into it better | 10:57:32 |
| Winter | fwiw my original solution in the same vein of this was just to name it cargo-config.toml instead, rather than putting it in .cargo within the vendor dir. it didn’t seem to break anything! | 11:03:39 |
| Winter | if it helps any: this crate breaks if you use cargo vendor outside of the sb lol | 11:04:12 |
| Toma | yeah it breaks if you dont have internet when hegeltest-c/build.rs runs, don't even need to vendor | 11:05:01 |
| Toma | I think I managed to "fix" it in a not very maintainable way, but hey, it builds!
https://github.com/NixOS/nixpkgs/pull/536012 | 12:08:04 |
