[tor-bugs] #25310 [Core Tor/Tor]: Document our policy for Rust dependencies

[Tor Bug Tracker & Wiki]

#25310: Document our policy for Rust dependencies
--------------------------------------------+------------------------------
 Reporter:  isis                            |          Owner:  (none)
     Type:  enhancement                     |         Status:  merge_ready
 Priority:  Medium                          |      Milestone:  Tor:
                                            |  0.3.4.x-final
Component:  Core Tor/Tor                    |        Version:
 Severity:  Normal                          |     Resolution:
 Keywords:  rust, tor-doc, review-group-35  |  Actual Points:
Parent ID:                                  |         Points:  1
 Reviewer:                                  |        Sponsor:  SponsorM
--------------------------------------------+------------------------------

Comment (by nickm):

 Hm.  I'm hoping that it's okay to take this in 0.3.3 and 0.3.4: it rebases
 cleanly to 0.3.3, but getting it into 0.3.2 would take more conflict-
 resolution than I have.

 Assuming that's the case, I made a branch called `bug25310_033` ... and
 then I ran into trouble.  If I don't update the libc dependency in tor-
 rust-dependencies, then the build will fail.  But if I do update the
 dependency, then 0.3.1 and 0.3.2 will fail (assuming they use libc), since
 the updateRustDependencies script will delete libc-0.2.2.22.

 Two options here:

   1. Maybe we should update the updateRustDependencies.sh script so that
 it adds new crates, but does not remove the old ones, since they may still
 be needed for older Tors?
   2. Maybe we should update all the old tor branches to libc-0.2.39 for
 now, but also search for a better solution?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25310#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online