15 ms·

> It works in Rust because the build.rs lets libraries do whatever they want during the build process, including invoking compilers for other languages. It's s

> It works in Rust because the build.rs lets libraries do whatever they want during the build process, including invoking compilers for other languages. It's still its own mess. You'll find plenty of people having problems with openssl, for instance.

oefrha 3y ago
I have the pleasure of maintaining a reasonably popular -sys crate, and getting it working on Windows is an absolute nightmare, especially considering the competing toolchains & ABIs (msvc and gnu) and millions of ways the C dependency can be installed (it’s a big one, and users may choose a specific version, so we don’t bundle it), with no pkg-config telling you where to look. No idea how build.rs being able to run any Rust code is an advantage, it’s not like setup.py can’t run any Python code and shell out. In fact, bespoke code capable of spitting out inscrutable errors during `setup.py install` is the old way that newer tooling tries to avoid. Rust evangelism is puzzling.
- oblio 3y ago
  Wait a second, I need to understand this better. If you cargo build, can that run a dependencies' build including trying to compile C and stuff?
  - oefrha 3y ago
    Yes, see https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html.
  - bogeholm 3y ago
    I believe build.rs can do pretty much anything: https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html
    - oblio 3y ago
      That's both scary and sad :-(
      - winstonewert 3y ago
        Why? If you are using a crate, its code will be running in your application. Its not really any more of a concern if it can run code while building.
        oblio 3y ago
        Yeah, but with binary packages you can add another lay of defense in depth, signed packages, signature checking, etc. It's not just about the original authors themselves, it can also be about attacks on the public repositories, for example.
- winstonewert 3y ago
  When I referred to build.rs - I merely meant that the build script made it possible to build code written in other languages - not that it solved all the problems. It very much doesn't solve all the problems involved.
wongarsu 3y ago
Though you get partially saved by the "FFI is defined in Rust" part, with many of the hard to compile crates offering optional prebuilt binaries for the part that's not rust.

oefrha 3y ago

I have the pleasure of maintaining a reasonably popular -sys crate, and getting it working on Windows is an absolute nightmare, especially considering the competing toolchains & ABIs (msvc and gnu) and millions of ways the C dependency can be installed (it’s a big one, and users may choose a specific version, so we don’t bundle it), with no pkg-config telling you where to look. No idea how build.rs being able to run any Rust code is an advantage, it’s not like setup.py can’t run any Python code and shell out. In fact, bespoke code capable of spitting out inscrutable errors during `setup.py install` is the old way that newer tooling tries to avoid. Rust evangelism is puzzling.

oblio 3y ago
Wait a second, I need to understand this better. If you cargo build, can that run a dependencies' build including trying to compile C and stuff?
- oefrha 3y ago
  Yes, see https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html.
- bogeholm 3y ago
  I believe build.rs can do pretty much anything: https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html
  - oblio 3y ago
    That's both scary and sad :-(
    - winstonewert 3y ago
      Why? If you are using a crate, its code will be running in your application. Its not really any more of a concern if it can run code while building.
      - oblio 3y ago
        Yeah, but with binary packages you can add another lay of defense in depth, signed packages, signature checking, etc. It's not just about the original authors themselves, it can also be about attacks on the public repositories, for example.
winstonewert 3y ago
When I referred to build.rs - I merely meant that the build script made it possible to build code written in other languages - not that it solved all the problems. It very much doesn't solve all the problems involved.

wongarsu 3y ago

Though you get partially saved by the "FFI is defined in Rust" part, with many of the hard to compile crates offering optional prebuilt binaries for the part that's not rust.