thepowersgang/mrustc

… and conspiratorial, Yes. > but I’m not the only one concerned about it.4 The only way to compile Rust’s compiler is using a binary package of the previous version released by the Rust Foundation. Or using https://github.com/thepowersgang/mrustc . And it is not released by the Foundation. > Since there exists only a single fully-functional, usable implementation of the Rust compiler, the Rust Foundation must be trusted. > Considering its history, owners, and track record of issues with mismanagement,5 The linked to blogpost is about a fuck up that a subset of people in the project, who were responsible for RustConf, caused. The ones with leadership position stepped down from them out o…

> It’s completely possible that Rust’s compiler contains a backdoor... The only way to compile Rust’s compiler is using a binary package of the previous version released by the Rust Foundation. this is interesting but idk if i get it. couldn't you compile it with a different rust implementation like https://github.com/thepowersgang/mrustc

You could use https://github.com/thepowersgang/mrustc to get relatively modern Rust compiler (1.90 currently apparently, but every now and then that is updated). Then build newer rustc from there to reach the current 1.99. But I don't get why some people are obsessed with bootstrapping. Yes it is good to be able to do it, but it isn't something you need to do regularly. Especially since rust had a much better cross compilation story than C or C++ (not as good as go or zig though), so you don't need to bootstrap on a new architecture, just cross compile to it. Furthermore, new architectures for hosting a compiler (as opposed to just a target, like microcontrollers) is a rare event. Just som…

> In general, the bootstrap relies on a binary package of the previous version. This is unacceptable for an otherwise source-only, self-contained distribution like the NetBSD sources. This does not paint the full picture. Rust can be bootstrapped with mrustc, which is written in C++ https://github.com/thepowersgang/mrustc Now, mrustc supports only Rust 1.74. To build Rust 1.92, you need almost 20 builds. But this can be done from source Guix has written about bootstrapping Rust from source (they care a lot about this). Here is how it looked like in 2018 https://guix.gnu.org/nb-NO/blog/2018/bootstrapping-rust/

> and rustc could include malicious code that isn’t obvious to an outside auditor. I believe mrustc [0] is generally considered the current defense against a trusting trust attack, and IIRC it has verified the lack of such an attack up to rustc 1.74, which is the latest version it currently supports. Presumably whenever gccrs comes online that will be yet another defensive layer. [0]: https://github.com/thepowersgang/mrustc