The specific notice mentions rust dependencies. Rust does not have shared libraries, so a Rust [security] update means all rust binaries must be completely rebuilt. That seems to be part of OpenBSD's concern, and perhaps this has "triggered" the poster.

user blackhaz random forum post found:

> mariourk, you're definitely not alone. The same breakage happens to FreeBSD desktops as well. I have been vocal around the forum a few times about this. Not every desktop user wants to upgrade all their packages every X months. The way the default repositories are structured, the upgrades are forced onto users. I am a huge proponent of using application bundles, like on Mac OS, as quite often those upgrades break complex desktop apps too. I don't mind upgrades but sometimes I need to stick with a specific version of software, or roll back after something went wrong, and if it came as a bundle with its own dependencies, it wouldn't have to depend on other stuff that is being "force-upgraded" periodically.

So his complaint is about the way FBSD handles updates; he is generally incorrect about shared libraries; and his comment is completely OT for this thread.

What's the concern with that, exactly? OpenBSD is a security-focused distribution, do they not do reproducible builds?

Virtually every Linux distribution and BSD share this concern. We've all complained about it to Rust upstream, but they don't care. To them, it's cheap to rebuild every Rust project every time the compiler is updated or the standard library needs a fix.

See for yourself: https://github.com/rust-lang/rfcs/issues/600

What's worse is that a lot of people are forgetting why we do it this way in the first place. While part of it was about saving disk space, the major reason we do this is for being able to fix things in a cheap way and have wide-ranging impact. Without this, things like security fixes to zlib, libvpx, or other important libraries would require finding all their reverse dependencies, patching them, and rebuilding them to incorporate the fixes.

It's incredibly important, but because nobody cares in Rust and Mozilla, we're all doomed...

Nonsense. Rust has shared libraries just as much as C and C++ do. Distributions can and do build individual Rust crates as shared libraries, and crate authors can go further and offer a shared library with a C ABI that remains stable across rustc versions. (The latter is what cbindgen is for.)

The problem here is that the maintainers don't want to keep multiple versions of a crate around, so when any single application uses a newer version it forces an update on all the rest. Which is exactly what Rust's tendency toward static linking avoids.