4 ms·
How many people read build.rs files of all the transitive dependencies of a moderately large Rust project? Autoconf is bad in this respect but it's not like th
by bonzini 3y ago
How many people read build.rs files of all the transitive dependencies of a moderately large Rust project?
Autoconf is bad in this respect but it's not like the alternatives are better (maybe Bazel).
- bdd8f1df777b 3y agoBazel has its problems but the readability is definitely better. And bazel BUILD files are quite constrained in what it can do.
- acdha 3y agoThe alternatives are _better_ but still not great. build.rs is much easier to read and audit, for example, but it’s definitely still the case that people probably skim past it. I know that the Rust community has been working on things like build sandboxing and I’d expect efforts to be a lot easier there than in a mess of m4/sh where everyone is afraid to break 4 decades of prior usage.
- bonzini 3y agobuild.rs is easier to read, but it's the tip of the iceberg when it comes to auditing. If I were to sneak in some underhanded code, I'd do it through either a dependency that is used by build.rs (not unlike what was done for xz) or a crate purporting to implement a very useful procedural macro...