1.5 KiB
Reviewed compatibility backport
The adjacent ../glib directory contains the complete official glib 0.18.5 crate archive,
whose SHA-256 is
233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5.
The original MIT license, copyright, Cargo metadata and source are retained.
Only src/variant_iter.rs differs from upstream: exactly the two-line fix from
https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34
changes the C output parameter from &p to &mut p and makes its local variable
mutable. SEARCHI-BACKPORT.json records every original source file's SHA-256
and its patched hash. Searchi provenance records and .gitattributes remain outside the upstream tree.
The desktop workspace patches crates.io to this compatible version because GTK 0.18 cannot use GLib 0.20. This is a local remediation for RUSTSEC-2024-0429, not an official upstream release or an advisory suppression. Its registry version still matches the advisory. Do not claim validation before actual optimized Linux regressions and native desktop checks are recorded.
When upgrading the desktop framework, check whether a compatible upstream
release includes the fix. Remove this override only after the selected complete
Linux dependency graph is safe. Reverify provenance and the exact diff after
any vendor change; keep upstream changes separate from searchi additions.
See docs/DEPENDENCY-REVIEW.md and tools/glib-regression at the repository root.