CodeVetter · Repo Unpack · Risk map
rust-lang/rust
The dominant risks are soundness and supply-chain. AGENTS.md explicitly classifies the query system, type checking, trait solving, MIR, borrow checking, const eval, layout, and codegen as soundness-sensitive where LLM implementation is banned. The compiler dlopens codegen backends and proc-macro dylibs, executes test binaries, downloads stage0 toolchains, and deserializes incremental caches — all trust boundaries. Several giant files (runtest.rs ~3.2k lines, queries.rs ~2.9k) concentrate coupling, and externally-maintained subtrees must not be edited in-place.
- AGENTS.md bans LLM implementation in soundness-sensitive areas — explicitly naming the query system, type checking, trait solving, MIR construction/optimization, borrow checking, const evaluation, normalization/semantic caches, layout/validity, and codegen — and requires a failing regression test before any bug fix.
- Codegen backend loading is a dlopen boundary: load_backend_from_dylib uses rustc_metadata::load_symbol_from_dylib to resolve __rustc_codegen_backend from a path derived from -Zcodegen-backend or the sysroot; a malicious/mismatched dylib executes arbitrary code in-process.
- bootstrap.py downloads stage0 compilers and CI LLVM over HTTPS and verifies sha256 against src/stage0 checksums; a stale/unchecksummed URL raises but any checksum drift blocks builds entirely (single trust anchor).
- The incremental on-disk cache (dep graph + query results + work products) is a hand-rolled binary format in rustc_incremental::persist::file_format — corruption or version skew here miscompiles incrementally or crashes; load_query_result_cache silently consumes it at GlobalCtxt creation.
- ICE handling writes a crash report to config.ice_file and installs a ctrlc handler that sets rustc_const_eval::CTRL_C_RECEIVED then hard-exits after 100ms — a safety valve that can truncate in-flight diagnostic/report writes.
- tidy's main() sets RUSTC_BOOTSTRAP=1 in-process to let Cargo read unstable manifest features — an env var that also unlocks unstable rustc features if it leaks into other subprocesses.
- Externally maintained subtrees (src/tools/cargo, clippy, rustfmt, miri, rust-analyzer, rustc_codegen_cranelift/gcc, llvm-project) are banned from in-place edits; CONTRIBUTING.md and AGENTS.md route changes to their owning repos — a major trap for agents editing the wrong tree.
- Concurrency blast radius: rustc_data_structures::sync::set_dyn_thread_safe_mode must be called before any Lock creation, and the jobserver is initialized from inherited MAKEFLAGS fds — misordered init or a misconfigured jobserver produces subtle parallel-frontend failures (warns 'build environment is likely misconfigured').
- Hotspots of coupling: compiler/rustc_driver_impl/src/lib.rs (1686 lines) sequences the entire pipeline; rustc_interface/src/passes.rs (1523) owns provider wiring and GlobalCtxt construction; rustc_middle/src/queries.rs (2905) is a macro-dense registry every subcrate's provide() feeds into — edits there have compiler-wide blast radius.
- compiletest executes compiled test binaries and on Windows mutates the process-global error mode (SetErrorMode SEM_FAILCRITICALERRORS|SEM_NOGPFAULTERRORBOX) plus sets __COMPAT_LAYER=RunAsInvoker — global state that is inherited by all child test processes.
- rustc_parse asserts at compile time that rustc_lexer, rustc_span, unicode-normalization, and unicode-width all agree on UNICODE_VERSION — dependency version drift here is a hard panic, so unicode-crate bumps must be coordinated.
- The jemalloc override in compiler/rustc/src/main.rs replaces malloc for the whole process including LLVM's C++ allocations via jemalloc-sys's override_allocator_on_supported_platforms feature — allocator experiments must go through this mechanism, not #[global_allocator], or C/Rust allocator mixing occurs across the rustc<->llvm dylib boundary.
- The `bors` CI environment holds AWS/S3 secrets; ci.yml deliberately scopes it to automation/bors/* branches on rust-lang/rust only — misconfigured branch rules or repo checks would expose artifact-upload credentials. (inferred)
- Session/env leakage: Session exposes env_depinfo/file_depinfo for drivers to record env vars and files the crate depends on; any env var read through the env_var_os query becomes a rebuild trigger — surprising cache invalidations if drivers over-record. (inferred)