# Risk map — rust-lang/rust

> Canonical page: https://codevetter.com/unpack/rust/risk-map

# Risk map — rust-lang/rust

Scanned commit c64de18c55c70d62aa88a5722dea8f8e263bacf3 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The dominant risks are soundness and supply-chain. AGENTS.md explicitly classifies the query system, type checking, trait solving, MIR, borrow checking, const eval, layout, and codegen as soundness-sensitive where LLM implementation is banned. The compiler dlopens codegen backends and proc-macro dylibs, executes test binaries, downloads stage0 toolchains, and deserializes incremental caches — all trust boundaries. Several giant files (runtest.rs ~3.2k lines, queries.rs ~2.9k) concentrate coupling, and externally-maintained subtrees must not be edited in-place.
- AGENTS.md bans LLM implementation in soundness-sensitive areas — explicitly naming the query system, type checking, trait solving, MIR construction/optimization, borrow checking, const evaluation, normalization/semantic caches, layout/validity, and codegen — and requires a failing regression test before any bug fix. — [AGENTS.md](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/AGENTS.md)
- Codegen backend loading is a dlopen boundary: load_backend_from_dylib uses rustc_metadata::load_symbol_from_dylib to resolve __rustc_codegen_backend from a path derived from -Zcodegen-backend or the sysroot; a malicious/mismatched dylib executes arbitrary code in-process. — [compiler/rustc_interface/src/util.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/util.rs) [compiler/rustc_metadata/src/creader.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_metadata/src/creader.rs)
- bootstrap.py downloads stage0 compilers and CI LLVM over HTTPS and verifies sha256 against src/stage0 checksums; a stale/unchecksummed URL raises but any checksum drift blocks builds entirely (single trust anchor). — [src/bootstrap/bootstrap.py](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/src/bootstrap/bootstrap.py) [src/stage0](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/src/stage0)
- The incremental on-disk cache (dep graph + query results + work products) is a hand-rolled binary format in rustc_incremental::persist::file_format — corruption or version skew here miscompiles incrementally or crashes; load_query_result_cache silently consumes it at GlobalCtxt creation. — [compiler/rustc_incremental/src/persist/save.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_incremental/src/persist/save.rs) [compiler/rustc_interface/src/passes.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/passes.rs)
- ICE handling writes a crash report to config.ice_file and installs a ctrlc handler that sets rustc_const_eval::CTRL_C_RECEIVED then hard-exits after 100ms — a safety valve that can truncate in-flight diagnostic/report writes. — [compiler/rustc_driver_impl/src/lib.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_driver_impl/src/lib.rs)
- tidy's main() sets RUSTC_BOOTSTRAP=1 in-process to let Cargo read unstable manifest features — an env var that also unlocks unstable rustc features if it leaks into other subprocesses. — [src/tools/tidy/src/main.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/src/tools/tidy/src/main.rs)
- Externally maintained subtrees (src/tools/cargo, clippy, rustfmt, miri, rust-analyzer, rustc_codegen_cranelift/gcc, llvm-project) are banned from in-place edits; CONTRIBUTING.md and AGENTS.md route changes to their owning repos — a major trap for agents editing the wrong tree. — [CONTRIBUTING.md](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/CONTRIBUTING.md) [AGENTS.md](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/AGENTS.md) [Cargo.toml](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/Cargo.toml)
- Concurrency blast radius: rustc_data_structures::sync::set_dyn_thread_safe_mode must be called before any Lock creation, and the jobserver is initialized from inherited MAKEFLAGS fds — misordered init or a misconfigured jobserver produces subtle parallel-frontend failures (warns 'build environment is likely misconfigured'). — [compiler/rustc_interface/src/interface.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/interface.rs)
- Hotspots of coupling: compiler/rustc_driver_impl/src/lib.rs (1686 lines) sequences the entire pipeline; rustc_interface/src/passes.rs (1523) owns provider wiring and GlobalCtxt construction; rustc_middle/src/queries.rs (2905) is a macro-dense registry every subcrate's provide() feeds into — edits there have compiler-wide blast radius. — [compiler/rustc_driver_impl/src/lib.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_driver_impl/src/lib.rs) [compiler/rustc_interface/src/passes.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/passes.rs) [compiler/rustc_middle/src/queries.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_middle/src/queries.rs)
- compiletest executes compiled test binaries and on Windows mutates the process-global error mode (SetErrorMode SEM_FAILCRITICALERRORS|SEM_NOGPFAULTERRORBOX) plus sets __COMPAT_LAYER=RunAsInvoker — global state that is inherited by all child test processes. — [src/tools/compiletest/src/runtest.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/src/tools/compiletest/src/runtest.rs) [src/tools/compiletest/src/lib.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/src/tools/compiletest/src/lib.rs)
- rustc_parse asserts at compile time that rustc_lexer, rustc_span, unicode-normalization, and unicode-width all agree on UNICODE_VERSION — dependency version drift here is a hard panic, so unicode-crate bumps must be coordinated. — [compiler/rustc_parse/src/lib.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_parse/src/lib.rs)
- The jemalloc override in compiler/rustc/src/main.rs replaces malloc for the whole process including LLVM's C++ allocations via jemalloc-sys's override_allocator_on_supported_platforms feature — allocator experiments must go through this mechanism, not #[global_allocator], or C/Rust allocator mixing occurs across the rustc<->llvm dylib boundary. — [compiler/rustc/src/main.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc/src/main.rs)
- The `bors` CI environment holds AWS/S3 secrets; ci.yml deliberately scopes it to automation/bors/* branches on rust-lang/rust only — misconfigured branch rules or repo checks would expose artifact-upload credentials. (inferred) — [.github/workflows/ci.yml](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/.github/workflows/ci.yml)
- Session/env leakage: Session exposes env_depinfo/file_depinfo for drivers to record env vars and files the crate depends on; any env var read through the env_var_os query becomes a rebuild trigger — surprising cache invalidations if drivers over-record. (inferred) — [compiler/rustc_interface/src/interface.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/interface.rs) [compiler/rustc_interface/src/passes.rs](https://github.com/rust-lang/rust/blob/c64de18c55c70d62aa88a5722dea8f8e263bacf3/compiler/rustc_interface/src/passes.rs)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)