3 ms·

> Give us wasm and precompiled, sandboxed binaries from crates.io! Even a precompiled, sandboxed WASM binary is already too opaque. Sure, it cannot directly do

by cesarb 3y ago

> Give us wasm and precompiled, sandboxed binaries from crates.io! Even a precompiled, sandboxed WASM binary is already too opaque. Sure, it cannot directly do bad things to the build machine (because it's sandboxed), but it still could inject malicious code into the final output of the compiler. And since it's a binary, it cannot be easily audited (through things like cargo-vet), unless it can be re-created from its source code through a reproducible build step. And if it can be re-created through a reproducible build step, then it's not much more than a cache. Which points to the true issue being deficient caching of some intermediate build steps; distributing precompiled binaries should not be actually needed.

mmastrac 3y ago
You're acting like the infrastructure for reproducible builds can't be built in Rust and then added in to tools like `cargo vet`. There are lots of options here, including having the proc macro wasm files built on crates.io. There is a reason why Rust doesn't yet have these sandboxed, pre-built macros and why the community needed a kick to get working on it. It's not easy, but it's entirely possible to reach the bar of auditability. You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right?
- cesarb 3y ago
  > You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right? Not necessarily, they could use their distribution's package manager to obtain the Rust compiler (which is what I do). Or they could use an older Rust compiler to build rustc and cargo from source (which is what I did back when Rust was newer). Yes, you cannot avoid having a pre-built compiler somewhere in the chain, but we should be working to minimize the number of these hard-to-audit dependencies, not increase them.

by cesarb 3y ago

mmastrac 3y ago

You're acting like the infrastructure for reproducible builds can't be built in Rust and then added in to tools like `cargo vet`. There are lots of options here, including having the proc macro wasm files built on crates.io. There is a reason why Rust doesn't yet have these sandboxed, pre-built macros and why the community needed a kick to get working on it. It's not easy, but it's entirely possible to reach the bar of auditability. You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right?

cesarb 3y ago
> You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right? Not necessarily, they could use their distribution's package manager to obtain the Rust compiler (which is what I do). Or they could use an older Rust compiler to build rustc and cargo from source (which is what I did back when Rust was newer). Yes, you cannot avoid having a pre-built compiler somewhere in the chain, but we should be working to minimize the number of these hard-to-audit dependencies, not increase them.