Code philosophy

Rust version

The SmolPhone project uses Rust 1.88 edition 2024. We only update when a dependency moves to a more recent version or when a new feature is required. Most published crates are usually compatible with the last ten versions of Rust.

If you need to update the Rust version, please refer to the relevant recipe.

Minimize dependencies

This project embraces a strict policy regarding dependency management. This aims to avoid potential security vulnerabilities and software bloat.

1. Think twice before adding a new dependency.

   If you think a dependency should be added, then justify why. This justification should be written in the commit that adds the dependency.

2. Avoid crates with dozens or hundreds of direct or indirect third-party dependencies.

   Third-party dependencies are crates that aren’t authored by the same organization or author.

   You can see the tree of dependencies of your project using cargo tree.

3. Audit small and untrusted crates

   Sometimes there is no better choice that a package authored by a single developer. In this case you should take the time to review the source code.

   Audit every update of the package. You should depend on an exact version of the package.

   Note that this doesn’t apply the restriction on the dependencies of untrusted-package. This is why you should avoid untrusted packages with untrusted dependencies.

We trust the following organizations:

• rust-lang The organization maintains:
  • the Rust toolchain (cargo, rustc, rustup, …)
  • rust-bindgen
• rust-embedded The organization maintains:
  • cortex-m
  • embedded-hal
  • embedded-alloc
  • embedded-io
  • heapless
• rust-embedded-community The organization maintains:
  • embedded-sdmmc-rs
• knurling-rs The organization maintains:
  • defmt
  • flip-link
  • probe-rs
• serde

When you add a new dependency, you should also ensure that its license is compatible with this project. You should also review the licenses of its direct and indirect dependencies. You can list the license of all dependencies using cargo license.

License

The Rust community dual-licenses its libraries under both the MIT and Apache 2.0 licenses. This provides flexibility for software that depend on them.

We chose to diverge from this practice in order to protect our work. All of our libraries and software are licensed under the Mozilla Public License 2.0 (MPLv2). This license requires sharing any modifications of our libraries and software, but still allows to freely depend on them without any copy-left contamination.

Thus, a software or library that depends on ours can still be licensed under a permissive license such as MIT or Apache 2.0. This makes ours libraries reusable by the Rust community.