ostree VS Clippy

Ansible makes mutable changes to the OS, task by task.

Nix is immutable. A new change is made entirely new, and only after the build is successful, all packages are "symlinked" to the current system.

Fedora Silverblue is based on ostree [1]. It works similarly like git, but on your root tree. But it requires you to reboot the whole system for the changes to take effect. Since Nix is just symlinked packages, you don't need to reboot the system.

More detailed explanation here [2].

[1]: https://github.com/ostreedev/ostree

[2]: https://dataswamp.org/~solene/2023-07-12-intro-to-immutable-...

This one is for the ostree bug currently ongoing: https://github.com/ostreedev/ostree/issues/2900

This sounds related to the ostree bug.

I definitely agree that immutability offers considerable value in regards to improving security. But arguably it's insufficient to pull the win over mutable Fedora due to the losses caused by the inability to install the kernel-hardened package and the lack of UKI (Unified Kernel Image) support.

Other hardening guides mention a Unified Kernel Image as another measure to further improve security. Unfortunately, once more, this is (currently) not supported on Fedora Silverblue. I haven't seen it being done on openSUSE Aeon either. Though, once again, I'd love to be corrected!

The fedora crew is working on it through ostree though, so both fedora Silverblue and flatpak will be getting it (as well as true immutability) in the future: https://github.com/ostreedev/ostree/issues/2867

Aside from what has already been mentioned, Unified Kernel Image isn't supported (yet).

I couldn't find it in the API guidelines either. From what I understand, the idea is that any trait bounds, which includes generic type parameter bounds and lifetime bound on a type (struct or enum) would be repeated back in the impl block

there is a nice discussion on this issue here: https://github.com/rust-lang/rust-clippy/issues/1689

You should not blindly follow clippy lints. They are sometimes wrong. Another example https://github.com/rust-lang/rust-clippy/issues/9782 .

I often write () = f() to assert that f() is unit. Unfortunately clippy warns on such code ( https://github.com/rust-lang/rust-clippy/issues/9048 ). There are very recent pull requests for this bug, so hopefully this bug will be fixed very soon. But meanwhile I invented this workaround: [()] = [f()] :)

Apart from running clippy on many projects being essential, clippy is also an exceptionally welcoming project, no matter your prior knowledge.

clippy is a great place to get started :) though it isn't exactly new.

clippy is also pretty compiler-adjacent and unlike rust-analyzer uses rustc's internal APIs. Don't let the size of the code base scare you off! It's actually feasible for a newcomer to contribute even such a substantial change as a new lint, and we have issues labeled as "good first issue" that come with mentorship, so you don't need to go it alone.

Yes, you could use it to write a lint. Although you might find it easier to just fork Clippy and add your own lints to their existing framework.

Check out the readme for more information.

They are two of my favorite Rust tools. If you haven’t tried them yet, I highly recommend giving them a try. Clippy can detect various lints in your code and guide you towards writing more idiomatic code. To install Clippy, simply run rustup component add clippy, and to run it within your workspace, execute cargo clippy. For more details, visit Clippy’s GitHub repository.