Source: librsvg Version: 2.54.4+dfsg-1 Severity: serious Tags: upstream Hi,
See the discussion on the Debian Rust maintainers list for background: https://alioth-lists.debian.net/pipermail/pkg-rust-maintainers/2022-August/022857.html For more details how to solve this in a way that makes ftp-masters happy, please refer to them. The vendor subdirectory in the librsvg source package contains copies of various Rust libraries in specific versions. Some of them are packaged in Debian (i.e. the version from Debian should be used), others contain autogenerated files for which the original source is not in Debian. Examples for this are - vendor/semver corresponds to the rust-semver package in Debian. Here version 1.0.10 is included while Debian currently only has version 1.0.4. Both versions should be API compatible so that's not necessarily a problem for switching to the Debian version. - vendor/memchr corresponds to the rust-memchr package in Debian. Currently these two have the same version. - vendor/png corresponds to the rust-png package in Debian. Here version 0.17.5 is included while Debian currently only has version 0.16.8. Both versions are not API compatible. - vendor/glib-sys corresponds to the rust-glib-sys package in Debian. Here version 0.15.10 is included while Debian currently only has version 0.14.0. Both versions are not API compatible at all. In addition the src/lib.rs in that subdirectory has exactly the same problem mentioned in the above discussion. It is autogenerated from GLib-2.0.gir by the gir tool, and GLib-2.0.gir is autogenerated from the GLib (glib2.0 source package) source code. Either the original source in the exact version used here and everything to generate the files has to be shipped with the source package, or the files have to be regenerated at build time with whatever is available in Debian. See the above discussion for more details. These are not all files affected. You'll have to check the whole content of the vendor subdirectory on every release and ideally make sure each of these are packaged in Debian in the correct version. -- System Information: Debian Release: bookworm/sid APT prefers unstable APT policy: (700, 'unstable'), (500, 'unstable-debug'), (100, 'experimental'), (1, 'experimental-debug') merged-usr: no Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.18.0-4-amd64 (SMP w/8 CPU threads; PREEMPT) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
