The interface is FFI, it has to be unsafe, because you can't guarantee anything about the C code. The rust code though, can be converted to pure Rust. A strate

The interface is FFI, it has to be unsafe, because you can't guarantee anything about the C code. The rust code though, can be converted to pure Rust. A strategy I use and most other FFI code I've seen, is to have a shim layer, which is unsafe, that calls through to safe code. And vise versa for calling out to C. The function definitions don't need to be unsafe, just the direct calls to C and conversions to C types.