Tracking issue for Path Prefix Remapping

[michaelwoerister]

This feature was originally requested in #38322. The PR that implements this in its unstable form is #41508. This will eventually become stable if the testing phase goes well.

[brson]

What's the next step to stabilize this? Looks like it probably won't be stable for 1.20?

[michaelwoerister]

Good question. I did not heard any complaints about the way things currently work -- which I interpret as everybody being happy :).

Some of the people initially interested in the feature were @jmesmon, @infinity0, @sanxiyn, and @jsgf. Do you have any feedback?

Other than that, two open topics are:

• The documentation (currently in the unstable book) needs a revamp. @jsgf found it confusing, IIRC.
• The exact form of the CLI has seen some discussion but there was no clear agreement on what would be best. The current form is -Zremap-path-prefix-from=_, -Zremap-path-prefix-to=_. The could be transformed to
  • -Cremap-path-prefix-from=_, -Cremap-path-prefix-to=_ or
  • --remap-path-prefix-from=_, --remap-path-prefix-to=_ or
  • something else altogether.

I personally would be fine with either of the first two options.

cc @rust-lang/dev-tools

[infinity0]

I haven't tested this yet but I'm still interested. When I get a chance, I'll test it with 1.19 in Debian and see if we get a reproducible build.

[oli-obk]

We use it in clippy for making our tests' stderr output OS independent. Works like a charm: https://github.com/Manishearth/rust-clippy/blob/master/tests/examples.rs#L29

[infinity0]

Is the duplication of the path with / and \ really necessary? I thought the stripping algorithm worked on whole-path components, so that trailing directory separators shouldn't be necessary.

[oli-obk]

Maybe it changed. But I had to implement it this way, otherwise it wouldn't work

[michaelwoerister]

I thought the stripping algorithm worked on whole-path components, so that trailing directory separators shouldn't be necessary.

The current implementation works on plain strings. It does not try to interpret them as paths.

[infinity0]

Oh right. I was going by the code at the bottom of this older comment, I didn't notice you had gone back to plain string matching. What was the reason? I know GCC also do plain string matching, but I actually prefer path-level matching because it would be easier to use. This cross-platform duplication issue is a further example in that area.

[jsgf]

@brson, @michaelwoerister I just hacked it up in buck and it all looks good. Once it's stable (at least, we have decided on a stable command line option), I can do a real diff.

Either -Cremap-path-prefix or --remap-path-prefix is fine by me.

[jsgf]

@michaelwoerister Do you think it's possible to stabilize this in the 1.21 timeframe?

[michaelwoerister]

@infinity0 I'm divided on whether path matching should be string- or component-based. Component-based is a bit more ergonomic in the cross-platform case. I'm not sure though if it can be somewhat less predictable in corner cases (e.g. strange Windows path prefixes).

@jsgf That should be doable.

I'm nominating this for the next @rust-lang/dev-tools meeting to discuss string matching and which form the CLI should take -- and then we can let the appropriate subteams vote on it.

@rust-lang/core: Which teams need to sign off on stabilizing this? Quick recap: This feature allows to remap file paths (in output messages and output artifacts) to be remapped. This is necessary for reproducible builds and helps with custom debugging setups.

[alexcrichton]

@michaelwoerister @rust-lang/dev-tools sounds good to me as a team for signing off!

[jmesmon]

On matching mechanism: an alternate to paths & strings is to use regexes. Strings works fine for me though.

[michaelwoerister]

This has been discussed in the @rust-lang/dev-tools meeting and the conclusion was that we want to stabilize in the following form:

• This becomes a single, non--C flag: --remap-path-prefix
• We change parameter passing to the GCC way: the option takes a single string argument of the form from=to. This means that the new prefix (the to part) cannot contain an equals sign, but otherwise this has the advantage of being shorter than the current unstable form and is close to prior art.
• The option will only be shown in the extended help output of rustc (i.e. when --help -v is passed).

@rfcbot fcp merge

[rfcbot]

Team member @michaelwoerister has proposed to merge this. The next step is review by the rest of the tagged teams:

• @brson
• @japaric
• @jonathandturner
• @killercup
• @michaelwoerister
• @nrc

No concerns currently listed.

Once these reviewers reach consensus, this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

[jonathandturner]

@rfcbot reviewed

[infinity0]

We change parameter passing to the GCC way: the option takes a single string argument of the form from=to. This means that the new prefix (the to part) cannot contain an equals sign, but otherwise this has the advantage of being shorter than the current unstable form and is close to prior art.

So in other words you would split on the final =, right? I prefer that to the current GCC behaviour, which splits on the initial = so that the from part cannot contain an equals sign.

[jsgf]

Does this need release notes? Is this where that gets tagged?

[johnthagen]

I can confirm that #44940 fixed the compile issues I was seeing when using this feature and a simple reqwest application on macOS and Windows.

Thoughts on privacy

I think this feature possesses the mechanics to more broadly address privacy issues for closed-source code. This may be out of scope for the current issue, but I wanted to bring it up now since this feature hasn't been fully implemented yet.

The current reality for closed source code is that any time a panic!() is used, the module name, line number, and column number will be leaked into the binary to support unwinding. This is true even if panic = 'abort' is specified. The root issue is that panic!() calls file!(). This could leak private, perhaps proprietary or sensitive, implementation details that the company may not want to be included in released binaries.

Example

Let's say a company creates a video game with some hidden content. If the source for that module included a panic!() (and note, even things like unreachable!() call panic!()), the module name could be leaked as a string:

src/hidden_dlc/extra_boss_fight/victors_betrayal.rs

Using this feature, the company now has a manual way to suppress this at compile time (cool!):

RUSTFLAGS=-Zremap-path-prefix-from=src/hidden_dlc/extra_boss_fight/victors_betrayal.rs -Zremap-path-prefix-to=

But note that this is very manual (need a -from/-to for each module), and you'd need to make sure you didn't forget modules.

Straw Man Proposal

If rustc let you suppress all uses of file!() at compile time, you could allow such companies to keep these sensitive implementation details out of the binaries. This also helps save on binary size if these strings are not needed.

RUSTFLAGS=-Zremap-path-prefix-from=* -Zremap-path-prefix-to=

[luser]

What's the current status of this? It looks like it's been approved for stabilization, but the plan is to change the option to a single --remap-path-prefix. Does that change just need to be made, and then this can ship on stable?

[jsgf]

I've been using the -Zremap-path-prefix- form in our build environment (I failed to guess when they'd stabilize) for a few months now, and it's been working well.

[michaelwoerister]

Yes, it's just waiting to be implemented. I've just been busy with other things. I'm glad to take PRs though.

[jsgf]

OK, I'm looking at it now.

[kpcyrd]

As a minor note, it would be interesting to have both $HOME and $PWD remapped to standard values for release builds. This is currently the only thing that I have to adjust manually for reproducible builds (besides #47135).

[jsgf]

They would only affect the build if you're explicitly referencing them with env!("HOME"), right? You could just do --remap-path-prefix=$PWD=./.

[kpcyrd]

@jsgf the binary includes my $CARGO_HOME into the binary by default, if I don't have that variable set it defaults to $HOME/.cargo. :)

I think my project root and my explicit or implicit cargo home should be remapped.

[jsgf]

@kpcyrd Well I guess that's an issue to be addressed in cargo.

[kpcyrd]

@jsgf you're right, I've opened an issue for that: rust-lang/cargo#5505

[XAMPPRocky]

Closing as this was stabilised in 1.26.0 and there doesn't seem to be any leftover features to be implemented.