Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor

[Yves-Alexis Perez]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wed, 2026-06-17 at 12:39 -0700, Brian Tarricone wrote:
> This is absolutely true, and is the one and only thing that worries me about
> using Rust.  I'm not sure what the solution is here, if there is one.  Both
> smithay and gtk-rs pull in quite a lot of transitive dependencies, and
> there's not much that can be done about that.  I think software ecosystems
> as a whole are only just starting to figure out what to do about supply
> chain issues around centralized dependency managers, and there's still a lot
> of work to be done to increase security and confidence.
> 
> One potential benefit we have here is distro packagers: most of our users do
> not compile and run Xfce from source.  They use packages built by their
> distro.  Debian (which includes Ubuntu/Xubuntu), for example, does not pull
> packages from crates.io on every build.  They package the source of each
> crate, and Rust application builds point to a local cargo registry to find
> dependencies.  This does suffer from the "trust on first use" problem, and I
> don't know what Debian does to vet initial package creation or later version
> updates.  But this does feel safer than pulling from crates.io on every
> single build (or blindly running 'cargo update' and ignoring its output). 
> Users who care about this sort of thing should be using a distro that also
> cares about this sort of thing.  (And if they aren't, then they have bigger
> issues than Xfce's compositor.)

Hey there,

chiming here with my Debian maintainer hat. We didn't yet really start
packaging 4.21 but I have to admit xfwl4 beeing in Rust does worry be a bit
from a maintainer perspective, for various reason (mostly because it's a new
and very different thing, and secondly because of the whole static build
approach which doesn't really fit the distro model, I think).

I've just started looking at the Rust ecosystem in Debian and what could be
our strategy for xfwl4 and its dependencies.

There's a really helpful `debstatus` command in cargo which indicates what is
missing from the distribution, and we're definitely not there yet:
https://paste.debian.net/hidden/cd97a155

Besides the missing packages, I'm worried about conflicting versions: xfwl4
seems to require versions older than what's in Debian, for some reason.

Also smithay (and maybe other crates) doesn't seem to do releases and I'm
unsure we can put in Debian only the exact version required by xfwl4
(especially if it's not on crates.io which seems to be the source expected by
Debian Rust ecosystem).

Everything above might not be a blocker, but there'll definitely a need for
some coordination once we'll try to package things.

Regards,
- -- 
Yves-Alexis
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmpsv94ACgkQ3rYcyPpX
RFsJjQgAst8R+cLUapk3JsA3XAU2c9QBVo1eFuzktEZiVaguF0y0lRMvyRV3kP5q
f4291DqF82a2M7nzaDX2N/g21eB2xje/Qppv8i0Z1UczsMkevfqbIiFkbrFDBPiu
QIJTlN6lFtBC3NOzRO1t2SIvw0NrFjwd31bJd0oVJQLxGYvAneAa/QeT0dpc8iv1
3NswstU6k3a860lzODyeM1OI5FY3Jm/v6zCq8oqSNPQNFIsp+Vysa0WIUMd/YKxL
wtrEH0XCcJ9mrMCDuDRffZc4zZFexKwLHU/fI62SYa12/HXmJ5trxWYrI5rpt18i
H8+8WHvJ1aFylzA+k/ckBb+6KKWfjw==
=0t1U
-----END PGP SIGNATURE-----