Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove paste dependency. #1064

Open
1 of 3 tasks
liurenjie1024 opened this issue Mar 10, 2025 · 7 comments
Open
1 of 3 tasks

Remove paste dependency. #1064

liurenjie1024 opened this issue Mar 10, 2025 · 7 comments
Labels
dependencies Pull requests that update a dependency file enhancement New feature or request good first issue Good for newcomers

Comments

@liurenjie1024
Copy link
Contributor

Is your feature request related to a problem or challenge?

As describen in #1053 , paste crate is no longer maintained.

Describe the solution you'd like

We need to refactor our code to remove depencendy of paste crate.

Willingness to contribute

  • I can contribute to this feature independently
  • I would be willing to contribute to this feature with guidance from the Iceberg Rust community
  • I cannot contribute to this feature at this time
@liurenjie1024 liurenjie1024 added enhancement New feature or request good first issue Good for newcomers dependencies Pull requests that update a dependency file labels Mar 10, 2025
@TennyZhuang
Copy link
Contributor

Does the crate really need maintain? It's really easy, outputs deterministic results, and has no runtime dependencies.

@Xuanwo
Copy link
Member

Xuanwo commented Mar 11, 2025

Does the crate really need maintain? It's really easy, outputs deterministic results, and has no runtime dependencies.

Hi, I fully agree with your statements here.

However, the ASF has been seen as open-source software stewards (according to the CRA), so it is our own responsibility to ensure our dependencies are up to date and well-maintained. Otherwise, at some point (though no one has yet), someone may raise a CVE against us, forcing us to take urgent action.

We can still defend our position as we've discussed here, but most end users—who may not even know what Rust is—only find us because our project appears in their SBOM. They will simply see that paste is unmaintained and treat it as a security issue.

Ultimately, we need to take action. We should either remove paste entirely or migrate to another library.

@sundy-li
Copy link
Contributor

There are three approaches

  1. Use rust nightly features concat_idents! instead
  2. Use other similar crates like https://github.com/wdanilo/eval-macro
  3. Expand the macro to be redundant codes

Which one do we prefer ?

@Xuanwo
Copy link
Member

Xuanwo commented Mar 11, 2025

  1. iceberg-rust needs to work under stable rust, so we can't.
  2. eval-macro is relatively new. Do we have any other options?
  3. It looks like we only use paste!() here:

https://github.com/apache/iceberg-rust/blob/cf780f437964494acd15d119ccdc2c63cc6633d8/crates/iceberg/src/arrow/schema.rs#L690C3-L692

will this be heavy work?

@liurenjie1024
Copy link
Contributor Author

  1. iceberg-rust needs to work under stable rust, so we can't.
  2. eval-macro is relatively new. Do we have any other options?
  3. It looks like we only use paste!() here:

https://github.com/apache/iceberg-rust/blob/cf780f437964494acd15d119ccdc2c63cc6633d8/crates/iceberg/src/arrow/schema.rs#L690C3-L692

will this be heavy work?

Both 2 and 3 LGTM. The usage of paste! is to remove duplication, and it seems not much duplication as only min/max is used.

@TennyZhuang
Copy link
Contributor

  1. Fork the crate and maintain it. (In fact, it’s likely that no work need to be done.)

@Xuanwo
Copy link
Member

Xuanwo commented Mar 11, 2025

The usage of paste! is to remove duplication, and it seems not much duplication as only min/max is used.

It would be great if we expand them directly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file enhancement New feature or request good first issue Good for newcomers
Projects
Status: No status
Development

No branches or pull requests

4 participants