EVERYTHING
According to Techtimes, the release of Git 2.55-rc0 marks a significant architectural shift for one of the world's most essential software tools. For the first time, Rust support is enabled by default during the build process. This means any environment attempting to compile Git from source without a pre-installed Rust toolchain will fail unless developers manually set the NO_RUST flag.
Addressing critical memory safety vulnerabilities
The decision to integrate Rust stems from a history of security flaws within Git's legacy C codebase. Since its inception in 2005, Git has relied on C for its performance and low-level control, but this also leaves it susceptible to buffer overflows and heap-based memory corruption. In late 2022, the project disclosed two critical vulnerabilities—CVE-2022-41903 and CVE-2022-23521—which allowed for potential remote code execution due to integer overflows.
A subsequent security audit in early 2023 revealed that the sheer scale of the C codebase makes it increasingly difficult to eliminate all memory-related issues. This trend is reflected across the broader tech industry, with major entities like Microsoft and Google reporting that approximately 70% to 75% of their annual CVEs are linked to memory safety flaws. Consequently, government agencies have begun urging a transition toward memory-safe languages.
Incremental integration and performance gains
Rather than a complete rewrite, the Git team is employing an incremental strategy to incorporate Rust. The new code is compiled into static libraries using Cargo, which are then linked into the existing build systems via a Foreign Function Interface (FFI). This allows C-based components to interact seamlessly with new Rust modules.
The primary focus for this update is the xdiff subsystem, which handles the heavy lifting for commands like git diff and git log. By porting these algorithms to Rust, developers expect significant performance improvements:
By leveraging Rust's ownership and borrow-checker system, Git aims to enforce memory safety at compile time rather than relying on manual developer discipline. This transition represents a major milestone in securing the foundational infrastructure of modern software development.