I've been developing and supporting a production-grade Rust ecosystem at a start-up now for three years. This isn't an experimental effort. We have two server systems we maintain and support multiple databases with both SaaS and on-premise infrastructure support models. We have developed FIPS-certified MPC encryption technology at our core. We support CLI, mobile, and web clients. We elected to build it all on top of Rust given the common promises of doing so around safety and performance.

Overall, we leverage Tokio and Axum as our primary frameworks and theses seem strongly supported. But, we also have a number of important secondary platforms. Increasingly, we're becoming concerned about the number of key crates that have remained at a 0.y.z version level with the resultant impacts on stability of their interfaces. And, it seems a growing number of key crates (r2d2 for maintaining the connection pool for Oracle being one example) seem to be abandoned by their maintainers with no clear path towards a succession plan in their ownership.

I bring all this up knowing I'm opening myself up for possible grief from the community, but in all seriousness I worry that these key issues around long-term viability of libraries in the Rust ecosystem will act as an anchor on the overall success of the Rust language which I very much love and admire.

I know some will comment around expectations being too high for what amounts to "free" resources such as these open source crates. And, there is a fairness to that. I'm not looking for handouts. I'm willing to put maintainer time into these key crates myself. But I am instead seeking to understand if we as a community have an overall plan for continuing to support these efforts. What is the path towards having new folks succeed unresponsive maintainers of key crates? (I use the "unresponsive" term not out of blame--I fully understand people move on and sponsors lose support from their "day job" bosses).

Does the Rust Foundation play a role here? Do they survey what libraries are needed to continue to boost Rust as a mainstream solution for corporate applications and then step in with grants and resources to keep these maintained and move them to 1.y.z releases?

In my personal life I'm headed towards retirement soon and would be willing to pitch in for the common good on some of these crates but there isn't even a clear path to doing so.

Thank you for your consideration.

6 posts - 4 participants

Read full topic