From b54e85a5a64596c004afdf71610f1c5595303a86 Mon Sep 17 00:00:00 2001
From: Sophie Herold <sophie@hemio.de>
Date: Fri, 27 Sep 2024 21:28:52 +0200
Subject: [PATCH] meson: Don't vendor dependencies in dist

We already had attacks on tarballs on the original package levels with
XZ Utils. If we bundle a lot of tarballs in every of our tarballs, that
makes things even harder to trace.
---
 build-aux/meson/dist-vendor.sh |  9 ---------
 meson.build                    | 10 ----------
 2 files changed, 19 deletions(-)
 delete mode 100644 build-aux/meson/dist-vendor.sh

diff --git a/build-aux/meson/dist-vendor.sh b/build-aux/meson/dist-vendor.sh
deleted file mode 100644
index 59580a9..0000000
--- a/build-aux/meson/dist-vendor.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-export DIST="$1"
-export SOURCE_ROOT="$2"
-
-cd "$SOURCE_ROOT"
-mkdir "$DIST"/.cargo
-cargo vendor | sed 's/^directory = ".*"/directory = "vendor"/g' > $DIST/.cargo/config
-# Move vendor into dist tarball directory
-mv vendor "$DIST"
diff --git a/meson.build b/meson.build
index afb8003..f323b47 100644
--- a/meson.build
+++ b/meson.build
@@ -54,14 +54,4 @@ gnome.post_install(
   gtk_update_icon_cache: true,
   update_desktop_database: true,
   glib_compile_schemas: true,
-)
-
-meson.add_dist_script(
-  'build-aux/meson/dist-vendor.sh',
-  join_paths(
-    meson.project_build_root(),
-    'meson-dist',
-    meson.project_name() + '-' + meson.project_version(),
-  ),
-  meson.project_source_root(),
 )
\ No newline at end of file