Rust shared libraries may be ineffective
|Reported by:||Owned by:|
When we build rustc with system llvm, we have
# When using system llvm prefer shared libraries link-shared = true
but a look at the standard library in BLFS-10.1 shows that it is called '/opt/rustc/lib/libstd-48d374b27c3276a7.so' and using ldd on programs which used rust suggests that none of them link to this, i.e. the required items are pulled in during the build.
That means that when CVE vulnerabilities are raised against the rust stdlib, upgrading rust to a fixed version is insufficient, all the packages which use rust may need to be rebuilt to be sure they do not pull in the old code.
This might also mean that using system llvm brings few benefits.