creusot VS mutagen

However, it seems that C is not "notified" whether --cfg thing is set, only the main crate being built is. Regardless of this flag, the dummy macro is always chosen. Am I doing something wrong? It should work; the Creusot project is doing something similar.

I believe https://github.com/xldenis/creusot is more similar in that it also uses proofs to prove rust code correct.

Wow that sounds really cool! I'm not an expert but does that mean that one day you could implement dependend types or refinement types in Rust as a crate ? I currently only know of tools like: Flux Creusot Kani Prusti

Easy reasoning does not end on memory safety. For example, deductive verification of Rust code is possible exactly because there's no reference aliasing in safe Rust

> No support for using something like separation logic within Rust itself to verify that unsafe code upholds the invariants that the safe language expects.

I think this is something we might see in the future. There are a lot of formal methods people who are interested in rust. Creusot in particular is pretty close to doing this - at least for simpler invariants

https://github.com/xldenis/creusot

Seems similar in principle to cruesot except as another language instead of as a layer on-top of rust.

You often encounter this entire thread of rhetoric when someone wants to put a diversion into the central argument, yeah but it doesn't ____.

But Rust does do that, match exhaustiveness, forcing the handling of errors and the type system enables things like CreuSAT [1] using creusot [2]

[1] https://news.ycombinator.com/item?id=31780128

[2] https://github.com/xldenis/creusot

> Creusot works by translating Rust code to WhyML, the verification and specification language of Why3. Users can then leverage the full power of Why3 to (semi)-automatically discharge the verification conditions!

Units of Measure, https://github.com/iliekturtles/uom

The base properties of the language enable things that can never be done in C++.

> I’ve been working on a tool: https://github.com/xldenis/creusot to put this into practice

Note that there are other tools trying to deal with formal statements about Rust code. AIUI, Rust developers are working on forming a proper working group for pursuing these issues. We might get a RFC-standardized way of expressing formal/logical conditions about Rust code, which would be a meaningful first step towards supporting proof-carrying code within Rust.

This is exciting! I've met with people from AdaCore and Ferrous systems (individually) several times and they're all serious, competent and motivated.

I'm curious what kinds of software they want to (eventually) verify, my PhD thesis is developing a verification tool for Rust (https://github.com/xldenis/creusot) and I'm always on the look out for case studies to push me forward.

The road to formally verified Rust is still long but in my unbiased opinion looking quite bright, especially compared to other languages like C.

There are two testing techniques you didn't mention: Snapshot tests (which are greatly simplified using the insta crate and mutation testing (which can be done on nightly with my mutagen crate.

How does this compare to mutagen?

Do you mean as part of build.rs? Yes, that's certainly doable, and has been done in the past. You can use env!("OUT_DIR") for that. Examples you may want to refer to include my mutagen crate and criterion.

Would be great if this could include mutation testing.

I wrote a good number of macros though, both macro_rules! and various proc_macros. The latest iteration of overflower has both, for example. mutagen is a mutation testing tool built as a proc macro, and it's helper library has a bunch of macros, too. compact_arena uses macros to tie unique lifetime tags to arenas.

Also there are far more mutation testing frameworks. I maintain the rust-based mutagen one. There are also LLVM-based ones (etc. mull) that can cover multiple languages (but may yield mutations not expressible in your preferred one).

Cargo (and Rust) makes it so easy to write test cases that you should really use it to find these kinds of bugs. And there are other good test crates available: mutagen, quickcheck, etc.

I had a student completely reachitecture my mutagen tool, and saw some working on various clippy contributions.