24 lines
1.5 KiB
Markdown
24 lines
1.5 KiB
Markdown
|
# Reviewed compatibility backport
|
||
|
|
|
||
|
|
The adjacent `../glib` directory contains the complete official `glib` 0.18.5 crate archive,
|
||
|
|
whose SHA-256 is
|
||
|
|
`233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5`.
|
||
|
|
The original MIT license, copyright, Cargo metadata and source are retained.
|
||
|
|
|
||
|
|
Only `src/variant_iter.rs` differs from upstream: exactly the two-line fix from
|
||
|
|
https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34
|
||
|
|
changes the C output parameter from `&p` to `&mut p` and makes its local variable
|
||
|
|
mutable. `SEARCHI-BACKPORT.json` records every original source file's SHA-256
|
||
|
|
and its patched hash. Searchi provenance records and `.gitattributes` remain outside the upstream tree.
|
||
|
|
|
||
|
|
The desktop workspace patches crates.io to this compatible version because
|
||
|
|
GTK 0.18 cannot use GLib 0.20. This is a local remediation for
|
||
|
|
RUSTSEC-2024-0429, not an official upstream release or an advisory suppression.
|
||
|
|
Its registry version still matches the advisory. Do not claim validation before
|
||
|
|
actual optimized Linux regressions and native desktop checks are recorded.
|
||
|
|
|
||
|
|
When upgrading the desktop framework, check whether a compatible upstream
|
||
|
|
release includes the fix. Remove this override only after the selected complete
|
||
|
|
Linux dependency graph is safe. Reverify provenance and the exact diff after
|
||
|
|
any vendor change; keep upstream changes separate from searchi additions.
|
||
|
|
See `docs/DEPENDENCY-REVIEW.md` and `tools/glib-regression` at the repository root.
|