2 ms·

You're acting like the infrastructure for reproducible builds can't be built in Rust and then added in to tools like `cargo vet`. There are lots of options here

You're acting like the infrastructure for reproducible builds can't be built in Rust and then added in to tools like `cargo vet`. There are lots of options here, including having the proc macro wasm files built on crates.io. There is a reason why Rust doesn't yet have these sandboxed, pre-built macros and why the community needed a kick to get working on it. It's not easy, but it's entirely possible to reach the bar of auditability. You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right?

cesarb 3y ago
> You realize that the first step people do when developing Rust is use a pre-compiled rustup to get a pre-compiled Rust binary toolchain, right? Not necessarily, they could use their distribution's package manager to obtain the Rust compiler (which is what I do). Or they could use an older Rust compiler to build rustc and cargo from source (which is what I did back when Rust was newer). Yes, you cannot avoid having a pre-built compiler somewhere in the chain, but we should be working to minimize the number of these hard-to-audit dependencies, not increase them.