@bert_hubert This library's only a few megs, 11 MB total if I'm looking at both libabsl20260107 and libabsl-dev on Debian sid.
What's wrong with one .so file, one .a file, one .pc file, and perhaps a hierarchy of preciously organized header files with one .h file at the top that includes everything?

“Alice laughed. ‘There’s no use trying,’ she said. ‘One can’t believe impossible things.’ I daresay you haven’t had much practice,’ said the Queen. ‘When I was your age, I always did it for half-an-hour a day. Why, sometimes I’ve believed as many as six impossible things before breakfast.” – Through the looking-glass, Lewis Carrol by John Tenniel To stay sane, we have to accept that our climate is going completely haywire, but that it is ok to mostly ignore that since saving ourselves is apparently not cost-effective.
@jschauma
> 13 (Trixie), 12 (bookworm), 11 (bullseye) all still vulnerable, but fixed in security releases
No, these releases have all been fixed. The red lines on the security tracker pages are indicating that the latest package version available in the install media archives is still vulnerable.
In Debian, the latest stable security update packages are made available via a first-party security mirror network, which is separate from the larger third-party mirror network that most packages are distributed from. This mitigates against a malicious third-party mirror operator withholding security updates.
When a stable point release update is prepared (e.g. the most recent was Debian 13.4, on March 14, 2026), all the security fixes released via the security archive, as well as other stable package updates, are copied into the base repository and installation media are refreshed. Then the red lines on the security tracker pages will disappear.
You could in theory install Debian off old install media and disable the security archive in your apt sources configuration. But that would be insane, that would be like installing Windows 11 off of a DVD and disabling Windows Update, and it would similarly be incorrect to say that Windows 11 is vulnerable to something because a fix is only available via Windows Update and the fix is not present on the latest DVD install image.
(sampled synthesizer sounds)
(heavy metal riff)
Do, do code, do code Z
Do, do code, do code Z
Do, do code, do code Z
Do, do code, do code Z
(heavy metal riff)
@miekg I get a statically linked "hello world" build when I run `RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target x86_64-unknown-linux-gnu` but as soon as I pull in a crate dependency that dynamically links to a native library (e.g. openssl-sys), I necessarily end up with a dynamically linked binary.
Check your `cargo tree` output for "-sys" crate dependencies I guess?