Address Rust interface review feedback

Stabilize the C ABI, preserve Cargo dependency tracking, register Rust unit tests, enforce unwind panics, and clarify native application trust semantics.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: achamayou

CMakeLists.txt

@@ -594,6 +594,19 @@ if(BUILD_TESTS)
 
   # Unit tests
   if(BUILD_UNIT_TESTS)
+    add_test(
+      NAME ccf_app_rust_test
+      COMMAND
+        ${CMAKE_COMMAND} -E env --unset=CARGO_BUILD_TARGET "CARGO_NET_RETRY=10"
+        "CARGO_HTTP_TIMEOUT=60" "CARGO_BUILD_RUSTC=${RUSTC}" ${CARGO} test
+        --manifest-path ${CCF_DIR}/src/rust/ccf-app/Cargo.toml --target-dir
+        ${CMAKE_BINARY_DIR}/cargo/ccf-app-test --locked
+    )
+    set_tests_properties(
+      ccf_app_rust_test
+      PROPERTIES LABELS unit WORKING_DIRECTORY ${CCF_DIR}/src/rust/ccf-app
+    )
+
     add_test(
       NAME verify_uvm_attestation_and_endorsements
       COMMAND

cmake/ccf_app.cmake

@@ -53,13 +53,7 @@ function(add_ccf_app name)
 endfunction()
 
 function(add_ccf_rust_app name)
-  cmake_parse_arguments(
-    PARSE_ARGV 1
-    PARSED_ARGS
-    ""
-    "MANIFEST_PATH;PACKAGE"
-    "DEPS"
-  )
+  cmake_parse_arguments(PARSE_ARGV 1 PARSED_ARGS "" "MANIFEST_PATH;PACKAGE" "")
 
   if(NOT PARSED_ARGS_MANIFEST_PATH)
     message(FATAL_ERROR "add_ccf_rust_app requires MANIFEST_PATH")
@@ -95,14 +89,13 @@ function(add_ccf_rust_app name)
     ${CARGO_TARGET_DIR}/${CARGO_PROFILE_DIR}/lib${RUST_LIB_NAME}.a
   )
 
-  file(GLOB_RECURSE RUST_APP_SOURCES CONFIGURE_DEPENDS ${MANIFEST_DIR}/src/*.rs)
-
   set(
     RUSTFLAGS
     "$ENV{RUSTFLAGS} --remap-path-prefix=${MANIFEST_DIR}=APP --remap-path-prefix=${CCF_DIR}=CCF --remap-path-prefix=$ENV{HOME}/.cargo=CARGO"
   )
-  add_custom_command(
-    OUTPUT ${RUST_APP_LIB}
+  add_custom_target(
+    cargo-build_${name}
+    BYPRODUCTS ${RUST_APP_LIB}
     COMMAND ${CMAKE_COMMAND} -E make_directory ${CARGO_TARGET_DIR}
     COMMAND
       ${CMAKE_COMMAND} -E env --unset=CARGO_BUILD_TARGET
@@ -112,16 +105,10 @@ function(add_ccf_rust_app name)
       ${PARSED_ARGS_PACKAGE} --manifest-path ${MANIFEST_PATH} --target-dir
       ${CARGO_TARGET_DIR} ${CARGO_PROFILE_FLAG} --locked
     WORKING_DIRECTORY ${MANIFEST_DIR}
-    DEPENDS
-      ${MANIFEST_PATH}
-      ${MANIFEST_DIR}/Cargo.lock
-      ${RUST_APP_SOURCES}
-      ${PARSED_ARGS_DEPS}
     COMMENT "Building Rust CCF application ${name}"
     USES_TERMINAL
     VERBATIM
   )
-  add_custom_target(cargo-build_${name} DEPENDS ${RUST_APP_LIB})
 
   if(EXISTS "${CCF_DIR}/src/rust/app_bridge.cpp")
     set(RUST_BRIDGE_SOURCE "${CCF_DIR}/src/rust/app_bridge.cpp")

cmake/gersemi_definitions.cmake

@@ -16,13 +16,7 @@ function(add_ccf_app name)
 endfunction()
 
 function(add_ccf_rust_app name)
-  cmake_parse_arguments(
-    PARSE_ARGV 1
-    PARSED_ARGS
-    ""
-    "MANIFEST_PATH;PACKAGE"
-    "DEPS"
-  )
+  cmake_parse_arguments(PARSE_ARGV 1 PARSED_ARGS "" "MANIFEST_PATH;PACKAGE" "")
 endfunction()
 
 function(add_ccf_static_library name)

doc/build_apps/example_rust.rst

@@ -31,9 +31,10 @@ which depends on the source-tree ``src/rust/ccf-app`` crate or the installed
 
 The helper maps CMake ``Debug`` builds to Cargo's development profile and all
 other build types to Cargo's release profile. It also links the generic C++ ABI
-bridge, launcher, and CCF libraries. Cargo sources, the manifest, and the lock
-file are build dependencies. The application should commit ``Cargo.lock`` and
-pin a Rust toolchain for reproducible builds.
+bridge, launcher, and CCF libraries. Cargo is invoked on every build and decides
+whether the crate is up to date, so Rust source edits do not require CMake to be
+reconfigured. The application should commit ``Cargo.lock`` and pin a Rust
+toolchain for reproducible builds.
 
 The complete records example is in :ccf_repo:`samples/apps/basic_rust`. It
 exports a registration function with ``ccf_app::export_app!`` and registers
@@ -47,8 +48,10 @@ retry a read-write handler when a transaction conflicts, so handlers should be
 deterministic and should not perform non-transactional side effects.
 
 Request, response, transaction, and map values borrow the callback context and
-cannot be retained. Rust panics are caught at the ABI boundary and become HTTP
-500 errors. C++ exceptions are also contained by the bridge.
+cannot be retained. The SDK requires Rust's ``unwind`` panic strategy so that
+panics are caught at the ABI boundary and become HTTP 500 errors. Builds using
+``panic = "abort"`` are rejected. C++ exceptions are also contained by the
+bridge.
 
 KV values and keys
 ------------------
@@ -59,8 +62,10 @@ common interface without prescribing a wire format.
 
 Map names retain the standard CCF security semantics. Names beginning with
 ``public:`` are written to the ledger in plaintext. All other application map
-names, such as the sample's ``records`` map, are private and encrypted. The
-framework continues to enforce reserved governance and internal map namespaces.
+names, such as the sample's ``records`` map, are private and encrypted. Like
+native C++ applications, native Rust applications are trusted code: raw map
+access does not enforce the namespace restrictions applied to JavaScript
+applications for reserved governance and internal maps.
 
 Read-only handlers receive only ``ReadOnlyMap``, so write operations are
 not available at compile time. Errors returned by a handler use the normal CCF

include/ccf/rust_ffi.h

@@ -12,88 +12,112 @@ extern "C"
 
   static const uint32_t CCF_RUST_ABI_VERSION = 1;
 
-  typedef struct ccf_rust_registry ccf_rust_registry;
-  typedef struct ccf_rust_endpoint_context ccf_rust_endpoint_context;
-
-  typedef struct ccf_rust_slice
+  struct ccf_rust_registry;
+  struct ccf_rust_endpoint_context;
+  struct ccf_rust_slice
   {
     const uint8_t* data;
     size_t len;
-  } ccf_rust_slice;
+  };
 
-  typedef enum ccf_rust_result
-  {
-    CCF_RUST_OK = 0,
-    CCF_RUST_NOT_FOUND = 1,
-    CCF_RUST_INVALID_ARGUMENT = 2,
-    CCF_RUST_READ_ONLY = 3,
-    CCF_RUST_INTERNAL_ERROR = 4
-  } ccf_rust_result;
-
-  typedef enum ccf_rust_auth
-  {
-    CCF_RUST_AUTH_NONE = 0,
-    CCF_RUST_AUTH_USER_CERT = 1
-  } ccf_rust_auth;
+#ifdef __cplusplus
+  using ccf_rust_result = int32_t;
+  using ccf_rust_auth = int32_t;
+  using ccf_rust_endpoint_callback =
+    ccf_rust_result (*)(void* user_data, ccf_rust_endpoint_context* ctx);
+  using ccf_rust_drop_callback = void (*)(void* user_data);
+#else
+typedef struct ccf_rust_registry ccf_rust_registry;
+typedef struct ccf_rust_endpoint_context ccf_rust_endpoint_context;
+typedef struct ccf_rust_slice ccf_rust_slice;
+typedef int32_t ccf_rust_result;
+typedef int32_t ccf_rust_auth;
+typedef ccf_rust_result (*ccf_rust_endpoint_callback)(
+  void* user_data, ccf_rust_endpoint_context* ctx);
+typedef void (*ccf_rust_drop_callback)(void* user_data);
+#endif
 
-  typedef int (*ccf_rust_endpoint_callback)(
-    void* user_data, ccf_rust_endpoint_context* ctx);
-  typedef void (*ccf_rust_drop_callback)(void* user_data);
+#ifdef __cplusplus
+  inline constexpr ccf_rust_result CCF_RUST_OK = 0;
+  inline constexpr ccf_rust_result CCF_RUST_NOT_FOUND = 1;
+  inline constexpr ccf_rust_result CCF_RUST_INVALID_ARGUMENT = 2;
+  inline constexpr ccf_rust_result CCF_RUST_READ_ONLY = 3;
+  inline constexpr ccf_rust_result CCF_RUST_INTERNAL_ERROR = 4;
+
+  inline constexpr ccf_rust_auth CCF_RUST_AUTH_NONE = 0;
+  inline constexpr ccf_rust_auth CCF_RUST_AUTH_USER_CERT = 1;
+#else
+enum
+{
+  CCF_RUST_OK = 0,
+  CCF_RUST_NOT_FOUND = 1,
+  CCF_RUST_INVALID_ARGUMENT = 2,
+  CCF_RUST_READ_ONLY = 3,
+  CCF_RUST_INTERNAL_ERROR = 4
+};
+
+enum
+{
+  CCF_RUST_AUTH_NONE = 0,
+  CCF_RUST_AUTH_USER_CERT = 1
+};
+#endif
 
   uint32_t ccf_rust_get_abi_version(void);
 
-  int ccf_rust_register_endpoint(
+  ccf_rust_result ccf_rust_register_endpoint(
     ccf_rust_registry* registry,
     ccf_rust_slice path,
     ccf_rust_slice method,
     ccf_rust_auth auth,
-    int read_only,
+    int32_t read_only,
     ccf_rust_endpoint_callback callback,
     ccf_rust_drop_callback drop,
     void* user_data);
 
-  int ccf_rust_request_body(
+  ccf_rust_result ccf_rust_request_body(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice* body);
-  int ccf_rust_request_query(
+  ccf_rust_result ccf_rust_request_query(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice* query);
-  int ccf_rust_request_path_param(
+  ccf_rust_result ccf_rust_request_path_param(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice name, ccf_rust_slice* value);
-  int ccf_rust_request_header(
+  ccf_rust_result ccf_rust_request_header(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice name, ccf_rust_slice* value);
 
-  int ccf_rust_response_status(ccf_rust_endpoint_context* ctx, uint16_t status);
-  int ccf_rust_response_header(
+  ccf_rust_result ccf_rust_response_status(
+    ccf_rust_endpoint_context* ctx, uint16_t status);
+  ccf_rust_result ccf_rust_response_header(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice name, ccf_rust_slice value);
-  int ccf_rust_response_body(
+  ccf_rust_result ccf_rust_response_body(
     ccf_rust_endpoint_context* ctx, ccf_rust_slice body);
-  int ccf_rust_response_error(
+  ccf_rust_result ccf_rust_response_error(
     ccf_rust_endpoint_context* ctx,
     uint16_t status,
     ccf_rust_slice code,
     ccf_rust_slice message);
 
-  int ccf_rust_kv_get(
+  ccf_rust_result ccf_rust_kv_get(
     ccf_rust_endpoint_context* ctx,
     ccf_rust_slice map_name,
     ccf_rust_slice key,
     ccf_rust_slice* value);
-  int ccf_rust_kv_has(
+  ccf_rust_result ccf_rust_kv_has(
     ccf_rust_endpoint_context* ctx,
     ccf_rust_slice map_name,
     ccf_rust_slice key,
-    int* present);
-  int ccf_rust_kv_put(
+    int32_t* present);
+  ccf_rust_result ccf_rust_kv_put(
     ccf_rust_endpoint_context* ctx,
     ccf_rust_slice map_name,
     ccf_rust_slice key,
     ccf_rust_slice value);
-  int ccf_rust_kv_remove(
+  ccf_rust_result ccf_rust_kv_remove(
     ccf_rust_endpoint_context* ctx,
     ccf_rust_slice map_name,
     ccf_rust_slice key);
 
   uint32_t ccf_rust_app_abi_version(void);
-  int ccf_rust_app_register(ccf_rust_registry* registry);
+  ccf_rust_result ccf_rust_app_register(ccf_rust_registry* registry);
 
 #ifdef __cplusplus
 }

samples/apps/basic_rust/CMakeLists.txt

@@ -15,5 +15,4 @@ add_ccf_rust_app(
   basic_rust
   MANIFEST_PATH ${CMAKE_CURRENT_LIST_DIR}/Cargo.toml
   PACKAGE ccf-basic-rust
-  DEPS ${CCF_DIR}/src/rust/ccf-app/src/lib.rs
 )