# @notriddle's Rust 2020 wishlist, or, Rust 2021: Integration
**URL:** https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216
**Category:** community
**Created:** [October 31, 2019, 5:14pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216 "2019-10-31T17:14:28Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@notriddle](https://internals.rust-lang.org/u/notriddle)
#### Post date: [October 31, 2019, 5:14pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/1 "2019-10-31T17:14:28Z")
Feedback is welcome!
> **[@notriddle's Rust 2020 wishlist, or, Rust 2021: Integration](http://txti.es/notriddle-rust-2020)**
>
> @notriddle's Rust 2020 wishlist or, Rust 2021: Integration This is just a brain dump. Doing all of this is not going to happen, but all of it is stuff I know of that impacts Rust's integration with th...
---
### Author:  [@197g](https://internals.rust-lang.org/u/197g)
#### Post date: [October 31, 2019, 7:02pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/2 "2019-10-31T19:02:26Z")
Glad to see someone share a similar view on missing pieces and expanding the use of Rust outside the immediate Rust ecosystem. So much in fact that I had chosen [the same slogan](https://www.hardmo.de/article/2019-10-29-rust-2020-vision.md). Your proposed working groups resonate with me especially.
---
### Author:  [@bjorn3](https://internals.rust-lang.org/u/bjorn3)
#### Post date: [October 31, 2019, 7:24pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/3 "2019-10-31T19:24:11Z")
> and rustc should be able to dump its file-level dependency tree (like `gcc -MF` -\> `rustc --print makefile` ?), in a stable format, preferably a format that already exists (like Make) rather than a bespoke JSON schema.
That is `--emit dep-info` right? It uses a format, which I believe is make compatible. (`file: depa depb`)
---
### Author:  [@notriddle](https://internals.rust-lang.org/u/notriddle)
#### Post date: [October 31, 2019, 7:31pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/4 "2019-10-31T19:31:59Z")
Thanks. I've now updated it.
---
### Author:  [@samsieber](https://internals.rust-lang.org/u/samsieber)
#### Post date: [October 31, 2019, 10:33pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/5 "2019-10-31T22:33:48Z")
> Improved support for third-party build systems in the crates themselves. In some cases, it's just a matter of coming up with standards and making pull requests against existing crates to implement them. For example, adding hooks for crates to make their system dependencies available to Meson or Bazel instead of using `build.rs` .
FWIW, I recall discussions around `build.rs` and what features would be needed to eliminate most if not all of bespoke build.rs logic. One of those was being able to specify dependencies to wrap - my recollection is fuzzy, so I don't have any nore details. But that move would dovetail nicely with a push to nake them available to 3rd party build tools.
Edit: found the discussion I was thinking about: [https://internals.rust-lang.org/t/build-rs-use-cases-and-stories-sought/9534?u=samsieber](https://internals.rust-lang.org/t/build-rs-use-cases-and-stories-sought/9534)
---
### Author:  [@notriddle](https://internals.rust-lang.org/u/notriddle)
#### Post date: [November 1, 2019, 12:44am UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/6 "2019-11-01T00:44:02Z")
It's not just that it "dovetails" with it. It's that, ideally, it would answer most of the big objections.
@kornel's [big objection](https://internals.rust-lang.org/t/build-rs-use-cases-and-stories-sought/9534/14) was that finding C libraries is hard, and all that hardness needs to be concentrated somewhere (in Rust, that hardness is the `build.rs` file). But if the Rust package is being built by Meson, then it should hand the responsibility for finding it over to [the Meson dependency checker](https://mesonbuild.com/Dependencies.html), and the weirdness of finding openssl is now `FindOpenssl.cmake`'s problem. The `openssl-sys` package might even continue to use `build.rs` if you were just using standalone cargo, only employing the declarative discovery system if the project-global "stop doing fancy stuff" flag were turned on.
---
### Author:  [@kornel](https://internals.rust-lang.org/u/kornel)
#### Post date: [November 1, 2019, 4:03am UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/7 "2019-11-01T04:03:46Z")
Yeah, if another dependency-aware build system is used, then it should be possible to "outsource" dependency search and configuration.
In the other thread there was a discussion about split of responsibility between "finding deps" build.rs and "code generating" build.rs. One special case is bindgen-using build.rs, which does both. So you can't just throw away all `build.rs` scripts of sys crates, you'd need a way to have two scripts and replace only the dep-searching one.
Alternatively, a build system like Bazel can sandbox the `build.rs` script so that it'll find the desired instance of a dependency, as it'll be the only one it can possibly find.
---
### Author:  [@Shnatsel](https://internals.rust-lang.org/u/Shnatsel)
#### Post date: [November 2, 2019, 8:16pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/8 "2019-11-02T20:16:17Z")
[Secure Code WG](https://github.com/rust-secure-code/wg) is the one maintaining a [security advisory database](https://github.com/RustSec/advisory-db). Discuss your security disclosure needs with them! Reproducible builds are also [right up their alley](https://github.com/rust-secure-code/cargo-repro).
There is a lot of work until we get the proper security update story in Rust. Right now the security update distribution story is nonexistent, it's impossible to check if you're even running a vulnerable version or not. I've [prototyped](https://github.com/Shnatsel/rust-audit) a first step towards solving that problem, assistance in drafting an RFC for Cargo based on this would be very welcome.
---
### Author:  [@notriddle](https://internals.rust-lang.org/u/notriddle)
#### Post date: [November 5, 2019, 6:37pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/9 "2019-11-05T18:37:13Z")
> [@Shnatsel](#):
>
> Reproducible builds are also right up their alley.
Ah, okay then. Thanks for the info!
---
### Author:  [@Shnatsel](https://internals.rust-lang.org/u/Shnatsel)
#### Post date: [November 5, 2019, 6:48pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/10 "2019-11-05T18:48:45Z")
Speaking of security updates, I've just opened an RFC for one piece of the puzzle: [https://github.com/rust-lang/rfcs/pull/2801](https://github.com/rust-lang/rfcs/pull/2801)
---
### Author:  [@notriddle](https://internals.rust-lang.org/u/notriddle)
#### Post date: [February 3, 2020, 6:48pm UTC](https://internals.rust-lang.org/t/notriddles-rust-2020-wishlist-or-rust-2021-integration/11216/11 "2020-02-03T18:48:50Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.