<story><title>Rustaceans at the border</title><url>https://lwn.net/SubscriberLink/889924/2b330ed9ea4a9e23/</url></story><parent_chain><item><author>enriquto</author><text>Rust is alright as a language, but cargo is extremely scary.  I hope a culture of coding in rust outside of the cargo &amp;quot;ecosystem&amp;quot; develops.  The current situation is alienating to reproducibility-oriented developers.</text></item></parent_chain><comment><author>cillian64</author><text>If you particularly want to replicate the common C situation where your dependencies are in-tree or you just don’t have external dependencies and write everything yourself then you are totally welcome to do that, even with Cargo. Nobody is forcing you to use external dependencies.  If your problem is other people writing software with external dependencies, then I guess you have different priorities to them.</text></comment>
<story><title>Rustaceans at the border</title><url>https://lwn.net/SubscriberLink/889924/2b330ed9ea4a9e23/</url></story><parent_chain><item><author>enriquto</author><text>Rust is alright as a language, but cargo is extremely scary.  I hope a culture of coding in rust outside of the cargo &amp;quot;ecosystem&amp;quot; develops.  The current situation is alienating to reproducibility-oriented developers.</text></item></parent_chain><comment><author>CraigJPerry</author><text>Is reproducability achiveable?&lt;p&gt;If you preserved an immutable tag of the source code and all its dependencies, a copy of the compiler version used and all build flags, then you’ve still got some big holes in your ability to reproduce a binary:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  1. OS version &amp;amp; patches installed
  2. OS configuration
  3. Hardware used (processors can have weird subtle bugs, microcode can affect execution behaviour, etc etc)
  4. Transient issues - the golden copy to be reproduced for some post event investigation might have contained a bit flip leading to impossible to reproduce verification signatures
&lt;/code&gt;&lt;/pre&gt;
Etc etc&lt;p&gt;Or is reproducability just a spectrum and you try to get further along it with some careful attention to detail, rather than an absolute to be achieved?&lt;p&gt;If the latter are you not cheaper just archiving binaries and tagging them with the source + deps + compiler + arch used to build them? Thats a 5 minute job to setup in your CI process and costs comparatively little to maintain vs wasting expensive human brains chasing down a futile goal.</text></comment>