Zngur: A C++/Rust interop tool
hkalbasi.github.io
hkalbasi.github.io
A far more important point is to address is that any FFI story with C++ that’s well executed is going to be great for the Rust ecosystem, and historically the community’s commitment to C++ interop has seemed tepid at best.
Even if one admits that Rust is strictly better than C++ for problems in the relevant domains, which seems an extraordinary claim that exceeds extraordinary evidence, there is still an ocean of C++ that we just can’t rewrite in even a decade, maybe not in a century.
There are use cases where Rust is just strictly a better choice: anything with an attack surface like a shell or an SSH daemon, or probably even a browser is an obvious candidate for a language with better reasoning about common attack vectors. I trust my Rust user land a lot more than my C userland.
But the “rewrite everything in Rust and push that via bad interop” is limiting the adoption of a cool language.
I’m a big fan of efforts to be more incremental.
The former claim seems unlikely as stated ("cannot") but is at least plausible in practice ("will not"). The latter makes no sense. C++ didn't exist fifty years ago, so you're asking that we believe somehow C++ was so well suited to some unspecified problems that rewriting software in a better language will take more than twice as long.
We certainly could reduce the use of fossil fuels by over 90% in a few months -- global nuclear war would probably work -- but I hope nobody has the will to make that happen. Conversely we could reduce them by that much over a 30 year span, but currently lack the will. So in that case the distinction would make sense.
But few are willing to "replace this working thing for a small gain" (and you can argue about rust but when something works and the downside is a statistical risk demonstrably of low probability* ) it will be hard to find many people willing to invest in it.
Eventually these old programs will be replaced but they won't be replaced with functional equivalents, any more than, say, wired home phones were replaced with fibre optic connections. They will be replaced with something de novo instead.
* nerds like us may say the risk is significant but the level of uproar in security breaches is negligible in practice and the actual incidence of bugs due to things like use-after-free is likewise tiny.
For example, if government regulations change, or the languages change, or engineering culture changes, or developers' desires and preferences change, suddenly "will not" becomes "will". But "cannot" is not so malleable.
That kind of thing takes time. And all of that time spent is also time that you continuously will have to justify to the executives why exactly we are doing this rewrite again and why there have been 0 new features added to the system because everyone has been busy with the rewrite. Or you assign just part of the people to the rewrite and the rest of the teams continue adding features to the existing system, and now you have to constantly play catch-up. Or everyone is responsible for both rewriting and for adding features, and new features are added into the legacy code and then also written in the new language.
It’s possible. I’ve been on teams that successfully rewrote legacy software in Rust. But until it literally becomes something that directly impacts revenue in an indisputable way – say through fines imposed for security incidents and those incidents being due to memory safety – there’s still a lot of organizations that will completely refuse these kinds of rewrites no matter how good the evidence is that they should be doing so for many reasons.
For what it's worth, I've rarely heard "rewrite it in Rust" pushed by the most influential and productive members of the Rust ecosystem. I think the disparity here is that the people pushing the more extreme agenda aren't the same ones making major projects that people use, so it turns out that most of the stuff being made is for writing new software since that's what the people making it are interested in.
Does anyone have thoughts about how mature Zngur/CXX/etc. are for a project like mine? Would it be reasonable to invest effort in creating those bindings? Thanks.
At this point I have a Claude project set up with Cxx documentation and it autogenerates most of my bindings.
I'm a fan of QML and would love to use Rust with it if pleasant Qt bindings are finally there.
I haven't really used it, but it seems to use the same idea, except it's native to Rust but comes with its own C++ and JavaScript bindings. I believe the project was started by some folks that left Qt (or some company that held the IPR at some point..).
It's definitely something that looks promising, though. Hope to replace Qt with it in the future if it works out.
Writing models has been surprisingly easy but there are still lots of annoyances like having to use QVariant to store everything because properties that refer to other QObjects must be raw *mut pointers. It's only taken a few hours each to write my models including a filesystem tree model. At this point I've got several examples of Rust models and C++->Rust conversions that I feed to Claude and it can easily write models from scratch or convert C++ models in the wild to custom Rust ones.
Sadly I haven't taken notes (I should) on my experience so far so my thoughts are rather disorganized. All that said, I've got instant hot reload of all the QML bits and I don't have to write C++ code with complex lifetimes so overall it's been a win.
So, Zngur allows you to use arbitrary Rust types in C++, store them by value in the C++ stack, and call arbitrary Rust methods and functions on them. But it doesn't bridge any C++ type into Rust, since it is not possible with the same ergonomic
Unfortunately it chooses to just assume your C++ is sound, it does explicitly warn you that you're signing up for this, but realistically this just doubles down on the known bad assumption in C++ that programmers are infallible.
Rather than (like Rust's native C FFI) marking the arbitrary C++ as unsafe, Zngur chooses to have you explicitly opt in if you want your code marked unsafe. We know from years of practical experience that C++ programmers rely heavily on unstated assumptions for the correctness of code, a practice which does not scale. A very large proportion of the C++ stdlib itself has a narrow contract, yet few practitioners memorise these contracts and they're unchecked - disaster looms.
https://hkalbasi.github.io/zngur/tutorial.html#calling-c-fro...
It sound like your quoted text is just saying that it’s not as ergonomic, you cannot use arbitrary C++ types directly in Rust, but you can use arbitrary Rust types in C++.
If you want to immediately use a C++ library in Rust with minimal manual effort, check out autocxx [0]. Its generated api isn't very idiomatic Rust, and it uses Pin, moveit, ... but it covers a good percent of C++ apis and you can also make an idiomatic wrapper for it in Rust.
Is this being used in some codebase? How stable is it? What are the plans for it?
I have so many questions, but will stick with these for now.