| 30 Jun 2026 |
 emily | so we should probably consider applying this to our libssh2, at which point we eat a Rust rebuild anyway | 17:45:24 |
 K900 | Have we not patched libssh this cycle | 17:45:27 |
| emily | I didn't check admittedly | 17:45:37 |
 whispers [& it/fae] | only one of them | 17:45:39 |
| whispers [& it/fae] | we need a few more iirc. was planning to look once i get off work unless someone does it first | 17:46:04 |
| emily | let's just patch libssh2 and bump Rust. we're already way ahead of schedule | 17:46:15 |
| emily | not worth the grief | 17:46:25 |
 Lach | Also, the other way is updating rustc to use llvm22 packages, I'm not sure if there is any implications in that | 17:46:35 |
| whispers [& it/fae] | looks like someone also proposed libssh2 bumping to an unstable commit a few hours ago: https://github.com/NixOS/nixpkgs/pull/537075 | 17:47:10 |
| emily | let's not, we're due to bump to 22 across the board anyway | 17:47:20 |
| emily | but it can wait another cycle | 17:47:24 |
| Lach | I mean, unless we update, packages using ndarray and zlib-rs are broken... | 17:48:00 |
| emily | that's scary, we should just cherry-pick | 17:47:59 |
| emily | if 1.96.1 fixes it it's better to update to 1.96.1 than to bump rustc LLVM to 22 | 17:48:23 |
| emily | both are equal rebuilds | 17:48:29 |
| Lach | Rustc 1.96.1 doesn't fix the avx512 problem | 17:48:54 |
| whispers [& it/fae] | * | 17:49:17 |
| emily | I see | 17:49:30 |
| emily | I'm a bit confused though | 17:49:39 |
| emily | if everything using zlib-rs should fail at build time, then we should be seeing a lot more fallout? | 17:49:50 |
| emily | for instance, jujutsu builds | 17:50:19 |
| emily | and that uses zlib-rs via gix | 17:50:25 |
| Lach | Hmm, let me check if it isn't gated under #[cfg(feature...)]... | 17:50:28 |
| Lach | Ah | 17:50:52 |
| Lach | #[cfg(feature = "avx512")] | 17:50:54 |
| Lach | https://github.com/trifectatechfoundation/zlib-rs/blob/5a96dcf8f36644074ca604dadae36591de5551a5/zlib-rs/src/adler32.rs#L5-L10 | 17:51:12 |
| Lach | Let me check ndarray then | 17:51:18 |
| emily | "Will the point release be on the latest stable version or will it target every impacted stable version (1.94-96)? Since without the fix 1.94- is dangerously unusable for anything doing branchless programming patterns, which could manifest as CVEs. I basically found the issue doing an innocent refactor in my project..." https://rust-lang.zulipchat.com/#narrow/stream/474880-xxx/topic/.23158214.3A.20stable-nominated | 17:51:56 |
| emily | it sounds like the 1.96.1 miscompilation fix is for a bug that was introduced in 1.94 | 17:52:03 |
| emily | which implies to me: not worth scrapping the cycle over | 17:52:13 |
