Arch Linux User Repository

I believe it it is; there's a CHANGELOG section after all, and it's close to impossible to accidentally make a git tag. You can just build from git; that'd also provide build provenance than building from some arbitrary tarball without signature or any other kind of provenance attestation.

I cleared out of date flag until it’s clear whether 0.10.1 is actually released.

@ChrisMorgan

I have a patch for your PKGBUILD 1. Change Apache to Apache-2.0 to make it SPDX compliant 2. Remove options=(!lto) 3. Add export CFLAGS+=" -ffat-lto-objects" 4. Changeprepare()` to better fit modern Rust Packaging Guidelines.

diff --git a/PKGBUILD b/PKGBUILD
index dd2c678..4221d3a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -2,25 +2,25 @@
 # Maintainer: Chris Morgan <aur@chrismorgan.info>
 pkgname=cargo-vet
 pkgver=0.10.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Supply-chain security for Rust'
 arch=('x86_64' 'i686' 'aarch64' 'armv7h')
 url='https://github.com/mozilla/cargo-vet'
-license=('Apache' 'MIT')
+license=('Apache-2.0' 'MIT')
 depends=(
     cargo
     gcc-libs
     glibc
     zlib
 )
-options=(!lto) # see: briansmith/ring#1444 (and #893)
 source=("$pkgname-$pkgver.tar.gz::https://github.com/mozilla/cargo-vet/releases/download/v$pkgver/source.tar.gz")
 sha256sums=('6ea308eb97df6356d76335fadf9cd0ab47c49208351ee7c500fc6c47ce204507')

 prepare() {
     cd "$pkgname-$pkgver"

-    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+    export RUSTUP_TOOLCHAIN=stable
+    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
 }

 build() {
@@ -28,6 +28,7 @@ build() {

     export RUSTUP_TOOLCHAIN=stable
     export CARGO_TARGET_DIR=target
+    export CFLAGS+=" -ffat-lto-objects"

     cargo build --frozen --release
 }

In 0.10.0 they look to have started automated releases, including source tarballs (which I’ve switched to) and x86_64-unknown-linux-gnu builds (which I won’t switch to, at least for now).

Tests are again failing in what looks to be an unimportant way; I’ve filed https://github.com/mozilla/cargo-vet/issues/638. In the meantime, makepkg --nocheck.

0.9.1 is a simple update, just bumping pkgver to 0.9.1 and the sha256sum to fd80641841445d6b2ba21db3dc9f9159c0881b6063bf2071647d9a67e57d7073.

Some of the tests are failing, but I think that’s https://github.com/mozilla/cargo-vet/issues/602 (tests depended on Cargo implementation details that changed, and although it’s fixed on Git no release has been made since).

I had to disable LTO to build in a clean chroot:

diff --git i/PKGBUILD w/PKGBUILD
index cd82b0a..3416397 100644
--- i/PKGBUILD
+++ w/PKGBUILD
@@ -8,6 +8,7 @@ pkgdesc='Supply-chain security for Rust'
 arch=('x86_64' 'i686' 'aarch64' 'armv7h')
 url='https://github.com/mozilla/cargo-vet'
 license=('Apache' 'MIT')
+options=("!lto")
 depends=(
     cargo
     gcc-libs

Without this change the package failed to build in a chroot with something like the following error:

          /usr/bin/ld: /build/cargo-vet/src/cargo-vet-0.6.1/target/release/deps/cargo_vet-ad15482393d7ca58: hidden symbol `GFp_ia32cap_P' isn't defined
          /usr/bin/ld: final link failed: bad value
          collect2: error: ld returned 1 exit status

  = note: some `extern` functions couldn't be found; some native libraries may need to be installed or have their path specified
  = note: use the `-l` flag to specify native libraries to link
  = note: use the `cargo:rustc-link-lib` directive to specify the native libraries to link with Cargo (see https://doc.rust-lang.org/cargo/reference/build-scripts.html#cargorustc-link-libkindname)