chrono VS rusqlite

The problem is that this effects higher languages too, because they often build on libc. And on some OSes, they don't have a choice, because the system call interface is unstable and/or undocumented).

For example in rust, multiple time libraries were found to be unsound if `std::env::set_env` was ever called from a multi-threaded program. See:

https://github.com/time-rs/time/issues/293 and https://github.com/chronotope/chrono/issues/499

https://github.com/rust-lang/rust/issues/27970

https://github.com/rust-lang/rust/issues/90308

> I think library authors should be more relentless and break compatibility every few years. We just need some conventions to not do so very often.

I indeed did this years ago---I'm the original author of Chrono [1]---and it wasn't well received [2] [3] [4]. To be fair, I knew it was a clear violation of semantic versioning but I didn't see any point of obeying that until we've reached 1.0 so I went ahead. People complained a lot and I had to yank the problematic release. By then I realized many enough people religiously expect semantic versioning (for good reasons though) and it's wiser to avoid useless conflict.

[1] https://github.com/chronotope/chrono

[2] https://github.com/chronotope/chrono/issues/146#issuecomment...

[3] https://github.com/chronotope/chrono/issues/156

[4] https://github.com/chronotope/chrono/blob/main/CHANGELOG.md#...

On that note, it would also be good to configure cargo-deny so that a CI pipeline and any maintainer can easily audit the current dependency versions. Sometimes CVEs require a new major semver (looking at you, time 0.1.x and thus chrono 0.4.x), so it's not enough to rely on people installing the tool with semver-compatible updates. Automatically auditing dependencies is really important, and given how easy cargo-deny makes it, I don't think many projects have any excuse not to configure it.

The example has been randomly taken from the [Chrono][https://github.com/chronotope/chrono/blob/main/src/offset/utc.rs] crate.

libc isn't "just a wrapper". Is a massive legacy codebase filled with hacks, UBs and bugs: https://github.com/chronotope/chrono/issues/499

Would love to have people test this, you can leave feedback here: https://github.com/chronotope/chrono/issues/674.

Security issues? I'm looking at the open issues, but haven't noticed any that seem to be security related (no security related labels either). What am I missing here?

"Rusqlite is an ergonomic wrapper for using SQLite from Rust." - Crates.io

If you're less concerned about the "structure" of your data (e.g., serializing into rust types) and just need tabular data that can be queried (e.g., how much did we bet on X date, who placed a bet on Y team, etc.) I would definitely lean more towards a SQLite database for that kind of work. rusqlite can get you a functional database fairly quickly with a little reading of the documentation (be sure to use the "bundled" feature).

Create a connection per task. WAL is probably a good idea.

Even using SERIALIZED mode, sqlite has multiple APIs which are completely broken if two clients touch the same connection (https://github.com/rusqlite/rusqlite/issues/342#issuecomment...).

Don't bother, just don't share connections between threads and use the regular multi-thread mode (do use that though).

It fails your "ship with a crate" requirement, but when it comes to "csv but too small for a database" it's always worth having a think about SQLite. Of note, the rusqlite crate with the bundled feature will download, compile, and link against sqlite.

You may want to read the Readme of Rusqlite, especially the Optional Features.

As far as I know, the only option for an embedded SQL database is SQLite. The most actively maintained one, for rust, seems to be rusqlite (https://github.com/rusqlite/rusqlite).

Yes, but it's readonly. Also they did not merge loadable extensions support, which I need - https://github.com/rusqlite/rusqlite/pull/910

rusqlite 0.27.0, which looks like it's still the latest version

SQLite is written in C, while workers is based on V8 isolates, so it mainly runs JavaScript. Fortunately, it also supports running WASM through initialising and calling WASM modules via JavaScript. Emscripten can be used to build WASM from C, but I'd rather use it through Rust (using rusqlite), so this is what I focus on right away. Workers can also be written entirely in Rust using worker-rs.