RFC: Trait Implementation Privacy with permits
#3903
Conversation
| Introduce a new syntax for restricting trait implementations to specific crates: | ||
|
|
||
| ```rust | ||
| trait Test permits mycrate_extra, crate { |
There was a problem hiding this comment.
how does the upstream trait declaration knows the name of the downstream crate name provide the impls? any crate can call themselves mycrate_extra, so this does not prevent "malicious impls" mentioned on line 21 at all
|
|
||
| Accidental or malicious impls: External crates can implement traits in ways that break invariants. | ||
|
|
||
| Audit difficulty: It is hard to know which crates are allowed to implement a trait. |
There was a problem hiding this comment.
It is generally very simple to work out how the Orphan Rule applies. The fundamental types work a little different, but there's only a handful of such types.
permits
| ## Motivation | ||
| Rust currently allows any downstream crate to implement traits for types they own, subject to the orphan rules. While flexible, this can lead to: | ||
|
|
||
| Accidental or malicious impls: External crates can implement traits in ways that break invariants. |
There was a problem hiding this comment.
If a malicious impl can cause memory safety issues, then the trait must be marked unsafe. Or rewritten to defend against malicious impls.
If it can't, then API design, documentation, assertions, and tests are usually the way this gets resolved. Are there specific scenarios where these aren't enough?
Rendered