commit: c49d4e391789b9b46f3310845e153d3aa4b74646
parent ec2c5473d3120c4f02406740cf6857e5a217f48a
Author: Haelwenn (lanodan) Monnier <contact@hacktivis.me>
Date:   Wed, 24 Sep 2025 23:29:20 +0200
notes/bootstrapping: mrustc got in Gentoo, replace "supply-chain" usage about cargo
Diffstat:
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/notes/bootstrapping.shtml b/notes/bootstrapping.shtml
@@ -95,22 +95,40 @@
 
 			<h3 id="rust">Rust</h3>
 			<p>
-				There is <a href="https://github.com/thepowersgang/mrustc">mrustc</a> but it's quite unstable and so far GuixSD seems to be the only distro using it.
-				Getting to stable also involves compiling the intermediary versions.
-				Rustc also vendors several other projects like LLVM and rust crates (enjoy non-installable libraries), similarly to other rust software.
+				There is <a href="https://github.com/thepowersgang/mrustc">mrustc</a>
+				(packaged in Guix and Gentoo)
+				but it tends to lag behind by about ten 1.x versions,
+				which sadly you each need to compile as intermediary steps.
+				Rustc also vendors several other projects like LLVM and rust crates
+				(enjoy non-installable libraries), similarly to other rust software.
 			</p>
 			<p>
-				GCC Rust Frontend is also not ready yet (2023-03) for userland, as <a href="#cargo">cargo</a> doesn't bootstraps…
+				GCC Rust Frontend is also not ready yet (2023-03) for userland,
+				as <a href="#cargo">cargo</a> doesn't bootstraps…
 			</p>
 
 			<h3 id="cargo">Cargo</h3>
 			<p>
-				As if rustc not bootstrapping wouldn't be enough, cargo, the buildsystem+dependency-installer for Rust software depends on <a href="https://github.com/rust-lang/cargo/blob/master/Cargo.toml">~60 direct libraries</a>, notably including 2+ git libraries, HTTP Authentication, OpenSSL.<br />
-				Cargo isn't a buildsystem, it's a full blown package manager, supply chain troublemaker (<a href="https://drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html">via designed-vulnerable crates.io</a>), …
+				As if rustc being a bootstrapping problem wouldn't be enough, cargo,
+				the buildsystem+dependency-installer for Rust software depends on
+				<a href="https://github.com/rust-lang/cargo/blob/master/Cargo.toml">~60 direct libraries</a>,
+				notably including 2+ git libraries, HTTP Authentication, and OpenSSL.<br />
 			</p>
 			<p>
-				It really ought to be replaced by something which only takes care of building code (or even just generating a <code>Makefile</code> or a <code>build.ninja</code> file), as was done in the C ecosystem many times in the past (pkg-config ⇒ <a href="https://gitea.treehouse.systems/ariadne/pkgconf">pkgconf</a>, ninja ⇒ <a href="https://github.com/michaelforney/samurai">samurai</a>, …).<br />
-				This isn't a system that scales, this is just creating a gigantic blob of software that cannot be reasonably audited, right in the toolchain.
+				Cargo isn't a buildsystem, it's a full blown package manager
+				and a troublemaker when it comes to dependency management due to
+				<a href="https://drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html">designed-vulnerable crates.io</a>.
+			</p>
+			<p>
+				It really ought to be replaced by something which only
+				takes care of building code (or even just generating
+				a <code>Makefile</code> or a <code>build.ninja</code> file),
+				as was done in the C ecosystem many times in the past
+				(pkg-config ⇒ <a href="https://gitea.treehouse.systems/ariadne/pkgconf">pkgconf</a>,
+				ninja ⇒ <a href="https://github.com/michaelforney/samurai">samurai</a>,
+				…).<br />
+				This isn't a system that scales, this is just creating a gigantic blob
+				of software that cannot be reasonably audited, right in the toolchain.
 			</p>
 
 			<h3 id="java">Java</h3>