cxx-rust-cssparser v1.0.0 released

[Aleix Pol]

I'm a bit confused, on the flatpak runtime we also don't have internet
access when building and it has been building fine. What we do there
is to download the crates assets on the source fetching step.

This week I saw that this workflow has also been adopted on
kdeplasma-addons for Plasma 6.7, so it's better to be ready.

Best,
Aleix


On Fri, May 15, 2026 at 8:25 AM Rik Mills <rikmills at kubuntu.org> wrote:
>
> On 15/05/2026 07:06, Luca Beltrame wrote:
> > In data venerdì 15 maggio 2026 03:06:41 Ora legale dell’Europa centrale,
> > Justin Zobel ha scritto:
> >> Then you'll need to vendor the Rust crates like Angelfish does:
> >> https://build.opensuse.org/package/show/KDE:Applications/angelfish
> >
> > It's not enough even after vendoring: https://invent.kde.org/libraries/cxx-rust-cssparser/-/merge_requests/18 is also needed, and tests still try to
> > access the network (and if network acces disabled, they complain about a crate
> > missing, although it is vendored).
>
> This is also going to be a breaking issue with K/Ubuntu and Debian,
> where buildds are very strictly not allowed to access the internet.
> This is essential for security and archive integrity, and it is always
> highly concerning when KDE developers think it is ok to download
> dependencies on the fly or access servers from what could, given the
> nature of the public internet, turn out to be compromised sources.
>
> Rik.