Skip to content

Conversation

@SwishSwushPow
Copy link

@SwishSwushPow SwishSwushPow commented Jan 7, 2026

Hi everyone,
during a dependency review we noticed that the wayland-backend and wayland-scanner crates include tests in the package published to crates.io. Reducing the amount of code (including the number of test files) makes reviewing crates and the whole supply chain much easier and since you already make use. of include in one of your Cargo.toml files I thought I'd go ahead and open this PR to apply this to backend and scanner as well.

Please let me know if anything needs changing or if there are further questions.

when publishing on crates.io
@ids1024
Copy link
Member

ids1024 commented Jan 7, 2026

you already make use. of include in one of your Cargo.toml

We do, though currently that's only being used to exclude files from a submodule that are of no relevance to wayland-rs. (If it wasn't a third party submodule, we just wouldn't have those in the repository at all.)

Is there any convention in the Rust ecosystem around this? The tests/ directories aren't relevant to most people getting crates from crates.io, though I suppose they would be used by https://github.com/rust-lang/crater, at least.

@SwishSwushPow
Copy link
Author

Thank you for taking a look at this. 🙏

As far as I am aware there are no conventions set in stone in the Rust ecosystem. With the rise of supply chain attacks we are personally convinced that reducing the amount of excess files in a packaged crate can only be a good thing because it makes reviewing dependencies easier and reduces the number of attack vectors. :)

You are correct that removing tests from crates.io makes it harder for crater to access and run these tests. I was looking for a bit more documentation about how crater is utilized by the compiler team, but I couldn't find a whole lot. A colleague pointed out resources about a recent crater run here (https://crater-reports.s3.amazonaws.com/2025-12-16-next-solver-global/index.html) and I had a look at the downloadable results json file.

{
  "name": "wayland-scanner-0.31.7",
  "url": "https://crates.io/crates/wayland-scanner/0.31.7",
  "krate": {
    "Registry": {
      "name": "wayland-scanner",
      "version": "0.31.7"
    }
  },
  "status": "",
  "res": "test-pass",
  "runs": [
    {
      "res": "test-pass",
      "log": "master%2361cc47e367d7be91e13bcd01e4e96e0e233d4f6d/reg/wayland-scanner-0.31.7"
    },
    {
      "res": "test-pass",
      "log": "try%23c9557a20e5ef2e0e02c29a5fafd850d1b7cf1e4f/reg/wayland-scanner-0.31.7"
    }
  ]
}
{
  "name": "wayland-backend-0.3.11",
  "url": "https://crates.io/crates/wayland-backend/0.3.11",
  "krate": {
    "Registry": {
      "name": "wayland-backend",
      "version": "0.3.11"
    }
  },
  "status": "",
  "res": "build-fail",
  "runs": [
    {
      "res": "build-fail:compiler-error(E0282, E0425, E0433)",
      "log": "master%2361cc47e367d7be91e13bcd01e4e96e0e233d4f6d/reg/wayland-backend-0.3.11"
    },
    {
      "res": "build-fail:compiler-error(E0282, E0425, E0433)",
      "log": "try%23c9557a20e5ef2e0e02c29a5fafd850d1b7cf1e4f/reg/wayland-backend-0.3.11"
    }
  ]
}

So the tests for wayland-scanner are actually included, but for wayland-backend there seem to be other issues (maybe related to wayland-sys).

I also found many other wayland related crates where the source including tests was pulled from github directly, but again, I couldn't learn more about the rational behind that. 😅

It might also be interesting to you that other popular crates such as reqwest or rustls also dropped the tests (e.g. recently for reqwest with some more discussion here: seanmonstar/reqwest#2759).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants