Provide a non-cargo alternative to bootstrap rust

[infinity0]

Requiring cargo to bootstrap rust (as is the case with the planned move to rustbuild) will greatly raise the cost of bringing it to new architectures, as well as making it harder to audit security-wise.

One way this could be done, is to add functionality in cargo to output a shell script that runs "what it would have done", then check this in with the rustbuild source code. (edit: assuming this output is human-readable)

For more information see http://bootstrappable.org/best-practises.html - for example, GNU Make does not require itself to build, it can be built from a shell script.

[xen0n]

Oh, I just realized there's an irlo thread discussing exactly this... Let's move there instead for the discussion?

This issue could be left open BTW, in case the proposal ever materialized, as a ready-made tracking issue.

[est31]

It seems to be easy to bootstrap cargo with only rustc and some traditional unix build tools available. Using this, you can then bootstrap rustc.

@xen0n Interesting thread! mrustc had quite some progress since that thread, it can now actually compile and run programs.

[infinity0]

We can't "bootstrap cargo with only rustc and some traditional unix build tools", if we don't have rustc in the first place. But future versions of rustc will need cargo.

So I/Debian would have to download the previous rustc and cargo binaries, and use these to build the current version of rustc and cargo. This is not a good situation, because it greatly increases the amount of binary code ("blob") that is needed to bootstrap the full operating system, either Debian or some other system. Reducing this is better for auditability and security purposes. Yes, we can never reach zero, but getting as close to zero as possible is still an improvement.

For us to be able to use mrustc, it would have to be able to compile all of cargo's dependencies plus cargo itself. Also, it does not contain a borrow checker so it would be quite dangerous to use these dependencies for anything else other than building a "proto-cargo" package (which would also not be borrow-checked) and then we could use this to build the real "cargo" Debian package. This adds extra baggage and is not a good situation either.

Another option is cross-compilation, but the support for that is very limited in Debian, and I believe in most other distributions too - both in terms of build success but also in terms of auditability of the build. The global cost may be less, for the output-a-shell-script option that I suggested.

(I'd suggest continuing the discussion here since it is more visible to other contributors, and the other thread is already 9 months old and isn't aware of the cargo+rustbuild issue, which is a step in the opposite direction.)

[est31]

So I/Debian would have to download the previous rustc and cargo binaries, and use these to build the current version of rustc and cargo.

No, as it was pointed out in #2110, it is possible to bootstrap cargo with rustc only. You will have to build cargo one way or another already, as you will want to include it in debian too. So all you need to do is to create one package for cargo that has been bootstrapped using the blob rustc, and use that cargo to bootstrap the current version of rustc.

Also, it does not contain a borrow checker so it would be quite dangerous to use these dependencies for anything else other than building a "proto-cargo" package (which would also not be borrow-checked) and then we could use this to build the real "cargo" Debian package. This adds extra baggage and is not a good situation either.

Sorry for bringing mrustc into the discussion. Its only useful when you want to eliminate the blob dependency on rustc. This issue isn't about this discussion. Note though that I agree with you that it would be required to have a separate proto-cargo package, however I'd think this wouldn't mean much considering the things gained (blob freedom, which isn't provided otherwise).

[steveklabnik]

Oh, I just realized there's an irlo thread discussing exactly this... Let's move there instead for the discussion?

Yes, let's do that please!

This issue could be left open BTW, in case the proposal ever materialized, as a ready-made tracking issue.

I like to try to keep the bug tracker clean; we can always make new issues. Without a plan of action to get the ticket closed, it will just hang around. Better to decide what, if anything, we need to concretely do in that thread, and then make a tracking issue later.

Thanks @infinity0 ! But yes, let's keep discussing this over there.

[xen0n]

@steveklabnik Fair point, especially from a triage perspective. Let's head over to the forums!

[infinity0]

it is possible to bootstrap cargo with rustc only.

Anything is "possible"; you're overlooking the fact that someone has to spend the time to write this stuff. @lucab had already looked into using dhuseby/cargo-bootstrap for Debian and decided it would take too much effort.

How do you want to continue that thread? It talks about issues beyond the scope of this issue. I don't want the solution to this issue, to be blocked by the other issues it talks about. Do any of you have any specific comments about the concrete proposal in my first post?

[est31]

Making cargo output a shell script sounds like a good workaround, but it would almost certainly require an RFC...