prometheus: drop dependency on protobuf
I'm opening this as a MR because prometheus' dependency on protobuf is a default feature, so should probably need an ACK from the Team. This is by no means a small change as far as prometheus is concerned, but it is one in terms of leaf packages. More details below.
Upsides: it decouples erbium from protobuf (via erbium-core, which depends on prometheus). erbium is one of 2 applications that (transitively) build-depends on protobuf, but doesn't actually use it. protobuf is affected by Bug#1103833 (CVE-2024-7254, RUSTSEC-2024-0437), so by decoupling erbium from it we'll be left with only one leaf (transitive) rdep of protobuf: protobuf-codegen. This cannot be decoupled from protobuf for obvious reasons, so it must either be fixed with protobuf, or be removed with it. I checked that building this MR + erbium-core + erbium succeeds, and protobuf is never installed in any of the chroots.
Downsides: protobuf is an important dependency of prometheus. Upstream conveniently factors the protobuf functionality into a separate feature so it can be easily disabled, but it still marks it as a default feature. Moreover, this protobuf
feature is a dependency of the push
feature, which is needed for push metrics. This in turn seems to be a relevant part of prometheus' functionality. All in all, introducing this change will seriously reduce prometheus' functionality in a way that does not affect any application in testing (that is, erbium), but that would affect users who want to use it as a library. Of course, if protobuf is removed prometheus will be too, so reduction of functionality is still the least of two evils in case of removal.