Concerns Regarding the Choice of Rust for the Xfce Wayland Compositor

[Wojciech S. Czarnecki]

> Dnia środa, 17 czerwiec 2026 21:39:15 (+02:00), Brian Tarricone napisał(a):
> > On Wed, Jun 17, 2026, at 08:16, Theron York wrote:


> > The second concern is the supply chain risk from Cargo and crates.io. Using Rust means pulling in a large number of external dependencies, which introduces a significant attack surface that does not exist in a pure C project.

I concur!
 
> This is absolutely true, and is the one and only thing that worries me about using Rust.  I'm not sure what the solution is here, if there is one.  Both smithay and gtk-rs pull in quite a lot of transitive dependencies, and there's not much that can be done about that.  I think software ecosystems as a whole are only just starting to figure out what to do about supply chain issues around centralized dependency managers, and there's still a lot of work to be done to increase security and confidence.

> I'm not sure what the solution is here, if there is one.

No external dependencies.  Vendor and vet everything. (Still vulnerable to the toolchain intrusions, but)

> > Xfce has always been trusted because its codebase is relatively small and auditable.
> 
> This feels like a bit of a stretch to me.  Do people really think about Xfce in these terms?  

I do.  

> the core components of Xfce include around 450,000 lines of C code.

It is the contained diff that matters for the pull audit (or at least mattered up to the AI based fuzzers finding old rot)

> That doesn't include other core-adjacent apps that most people will run (xfce4-notifyd, xfce4-appfinder, etc.) and any panel plugins outside the core included with xfce4-panel.  GTK and its major dependencies amount for another whopping 1,270,000 lines of C code.

Valid.  Though the same transparency of self contained repos exists with them (ummm, not sure whether it stands still).


> At any rate, xfwl4 is going to have its first preview release soon, and I see no reason to change course on this.
I am ok with Rust as a language.  Thoughm consider the Cargo infrastructure as the threat to contain, please.

> Regards,
> Brian

-- 
Wojciech S. Czarnecki
^^o^^ OHIR-RIPE