graphics/librsvg2-rust appeared (in ports 20a78f41da98) when lang/rust supported only aarch64, amd64, i386. Since then lang/rust gained support for armv6 (until ports 988dc662364d), armv7, powerpc64, powerpc64le, powerpc (32bit), riscv64 and src/ dropped support for ia64, pc98, sparc64, mips*. Upstream no longer maintains C version: 3 years has passed since the last release. While there're no *known* vulnerabilities the code is no longer audited either. Some ports no longer build with the old version (e.g., x11/lavalauncher, x11/swayimg, maybe more but didn't test).
Created attachment 239921 [details] v1 (apply via "git am") Remove LIBRSVG2_DEFAULT machinery and drop -rust suffix. Curiously, some ports didn't respect LIBRSVG2_DEFAULT: - multimedia/py-mat2 - textproc/py-sphinxcontrib-svg2pdfconverter - x11-wm/fvwm3
No. As long as the Rust toolchain is not usable under QEMU and other factors, this is not a good idea.
(In reply to Charlie Li from comment #2) If no one is going to QA runtime then this port is garbage and should be marked as FORBIDDEN or removed. Selectively adding workarounds for some Rust-based ports doesn't scale. Are you going to gatekeep Rust in any library with many consumers? What makes Rust so special compared to other stuff broken in qemu-user-static? To workaround qemu-user-static bugs just prefetch librsvg2(-rust) as binary package. If poudriere cannot prefetch dependencies due to out-of-date or marked as IGNORE then fix it or hack the ports tree locally until it does.
prefetch is not foolproof and absolutely useless with non-default OPTIONS or when the package is not built on the default builders for whatever reason. I do in fact daily drive this on my non-amd64 machines without issue. Gatekeeping is necessary when this proposed removal ends up effectively removing nearly all practical desktop application support for a given otherwise supported platform. Rust is special considering that more projects, particularly those infrastructure-critical or "feature" applications, are choosing to adopt it based on tier-1 support on platforms they care or know about (hint: not us)