From cea7553eff80f20f16bdab32ccd974d21b76aca8 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Fri, 26 Jun 2026 10:48:26 +0200 Subject: docs: explain vendored crates rationale and regeneration Add a Vendored Crates section to the root README covering why Rust packages ship a vendored tarball (SBo builds run offline in a clean chroot) and how to regenerate it reproducibly with cargo-vendor-filterer and SOURCE_DATE_EPOCH. Co-Authored-By: Claude Opus 4.8 --- README.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/README.md b/README.md index 27a658d..95b550b 100644 --- a/README.md +++ b/README.md @@ -61,3 +61,37 @@ cp .extras/hooks/* .git/hooks/ && chmod 0755 .git/hooks/{pre,post}-commit (`SBo/.tar.gz`) for any added or updated package. To answer the prompt non-interactively, set `SBO_ARCHIVE=yes` or `SBO_ARCHIVE=no` in the environment. + +## Vendored Crates (Rust packages) + +Rust packages such as `feroxbuster` build from a vendored crates tarball +(`--vendor.tar.gz`) declared as a second source in the `.info` +file, alongside the upstream tarball. The SlackBuild unpacks it, points cargo +at it via `.cargo/config.toml`, and builds fully offline (`cargo build +--offline --locked`). + +This mirrors how SlackBuilds.org packages Rust (and Go) software. SBo builds +must be reproducible from the checksummed sources declared in `.info` and run +in a clean chroot with no network access. Letting cargo fetch from crates.io +at build time would break that: builds would depend on crates.io being +reachable and unchanged, and the SBo build farm (which runs offline) would +reject the package. + +The vendor tarball is generated once per version with `cargo-vendor-filterer` +and hosted by the maintainer. `SOURCE_DATE_EPOCH` is pinned to the upstream +release tag's commit date so the archive is byte-for-byte reproducible: + +```bash +tar xf feroxbuster-.tar.gz && cd feroxbuster- +export SOURCE_DATE_EPOCH="$(date -u -d '' +%s)" +cargo vendor-filterer \ + --platform=x86_64-unknown-linux-gnu \ + --prefix=vendor \ + --format=tar.gz \ + feroxbuster--vendor.tar.gz +``` + +The tag commit date comes from the GitHub API +(`commits/` → `.commit.committer.date`). Then update `MD5SUM_x86_64` for +the new tarball in the `.info` file. The exact command is also recorded in the +package's own `README`. -- cgit v1.2.3