Re: [PROPOSAL] Builder, a build system integration for Emacs

[Gregory Heytings]

> So if you build a Rust program Foo, its dependencies will cause some 
> libraries to be loaded from crates.io, and their dependencies will cause 
> other libraries to be loaded from crates.io, and so on recursively.  Is 
> that right?

That is right.

> And if any of those libraries specifies a nonfree dependency, that 
> nonfree code will get compiled into the program Foo -- right?

That is right.

> If so, that puts freedom at risk.  It means that any time you build a 
> Rust program that you have not thoroughly studied, you don't know 
> whether it will incorporate nonfree software.
>
> Have I made any mistake in this reasoning?

The mistake is that those who care about software freedom can easily check 
whether a program incorporates non-free code, _without_ thoroughly 
studying that program.

There are at least two options to do that, which were already mentioned 
upthread: (1) running "cargo tree -f '{l}'", which will display the 
license of each of the dependencies of the program, recursively (that 
option works out of the box), and (2) installing a plugin for cargo, named 
"cargo deny", which is itself free software, and with which you can check, 
again recursively, whether all the dependencies of a program are free 
(more precisely: have a license that is present in the list of licenses 
you have chosen to allow).

> I think we should move this to gnu-prog-disc.

I'm not subscribed to that mailing list, which AFAIK is an internal 
mailing list with restricted access.