From fd041fbec72283baae5a7feb2c1c148d9bbeb771 Mon Sep 17 00:00:00 2001
From: Martin Pluskal <martin@pluskal.org>
Date: Wed, 5 Aug 2026 12:58:09 +0200
Subject: [PATCH] Make the bundled SQLite an opt-out default feature

libsqlite3-sys's `bundled` feature compiles a private copy of SQLite into
the rtk binary. That is the right default for the prebuilt binaries the
installer ships, but it is a blocker for Linux distribution packages: a
statically linked SQLite has to be tracked and rebuilt separately for
every SQLite CVE, and most distribution policies forbid shipping bundled
libraries outright.

Move it behind a `bundled-sqlite` feature that is on by default, so
nothing changes for `cargo build`, `cargo install` or the release
workflow, while a packager can build with `--no-default-features` and get
a binary that links the system libsqlite3 and inherits the distribution's
SQLite security updates.
---
 Cargo.toml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index d945b7341d..2a835fd3fc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,7 +22,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["preserve_order"] }
 colored = "3"
 dirs = "5"
-rusqlite = { version = "0.31", features = ["bundled"] }
+rusqlite = { version = "0.31" }
 toml = "0.8"
 chrono = "0.4"
 tempfile = "3"
@@ -34,6 +34,14 @@ quick-xml = "0.37"
 which = "8"
 automod = "1"
 
+[features]
+default = ["bundled-sqlite"]
+# Compile and statically link SQLite from the copy vendored in
+# libsqlite3-sys. Distribution packages build with
+# --no-default-features so the binary links the system SQLite and is
+# covered by the distribution's SQLite security updates.
+bundled-sqlite = ["rusqlite/bundled"]
+
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"