TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Eurydice is a Rust-to-C compiler project within the Aeneas formal-verification effort. It aims to preserve the structure and relevant semantics of Rust code in generated C, which may help projects that depend on C-based verification and compliance tools. Its output has limitations, including generic-code expansion and a strict-aliasing caveat.
Eurydice, a project that translates Rust programs into C, is designed to preserve much of the source code’s structure rather than optimize the output for machine code. The approach could help high-assurance software projects use Rust while continuing to work with verification and compliance tools that currently expect C, according to a report by LWN.net.
Eurydice follows a compiler pipeline: it translates Rust into an intermediate representation, applies a series of passes and emits C. Its stated distinction from conventional compiler output is that it tries to keep the program’s structure recognizable while removing or translating Rust features that C does not provide. The report says the project has been used to translate some post-quantum cryptography routines from Rust to C.
LWN illustrates the approach with Rust functions for calculating a greatest common divisor and a least common multiple. Eurydice’s output retains the functions’ conditional and arithmetic structure, using temporary variables where needed to make evaluation order explicit. The report contrasts this with optimized output from rustc, which it describes as less readable because it is aimed at producing machine code. Whether Eurydice’s generated C is readable is partly a matter of judgment; its code structure is the more concrete distinction.
Preserving evaluation order can matter for semantics. In the example, Rust guarantees that an overflowing multiplication that causes a panic occurs before side effects from the later function call. C does not provide the same guarantee for expressions generally, so the generated code separates the multiplication into a statement before the call. Eurydice’s output is not simply a textual rewrite: the compiler must account for differences in how the two languages define behavior.
C Tooling for Rust Projects
Many verification and compliance workflows are built around C, while Rust tools may not be accepted or supported in those environments. Translating Rust into C could let teams retain some Rust code while presenting it to existing analysis tools in a language those tools understand. The report frames this as a possible bridge until tools can work directly with Rust, and as an option for systems that have a C compiler but no working Rust compiler.
That potential depends on more than whether the generated program runs. For high-assurance work, the generated C must preserve the source program’s relevant behavior in a form that analysis can interpret. Eurydice’s attention to code structure and evaluation order addresses that need, but the report does not establish that every verification workflow accepts its output or that the translation eliminates the need to review the generated C.
As an affiliate, we earn on qualifying purchases.
Aeneas and Earlier Translators
Eurydice began in 2023 and is part of Aeneas, a project developing tools related to formal verification of Rust programs. The report says Aeneas projects are maintained by people employed by Inria, France’s national computer-science research institution, and Microsoft, and that outside contributions are accepted. Eurydice includes code under both the MIT and Apache-2.0 licenses.
The project adds to a broader effort to support Rust beyond its original compiler route through rustc and LLVM. LWN names mrustc, GCC’s Rust support (gccrs), rust_codegen_gcc and Cranelift among projects that have advanced alternative Rust compiler implementations. Eurydice has a different focus: producing C source rather than another route to machine code.
Its approach builds on KaRaMeL, which translates the F* programming language into C. F* is a dependently typed functional language used in developing cryptographic libraries. LWN identifies KaRaMeL as a precedent for translating a higher-level language into structurally preserved C; the supplied report does not provide further detail about its results or relationship to Eurydice beyond that foundation.
“Eurydice has a more ambitious goal: converting Rust code to clean C code.”
— LWN.net report
As an affiliate, we earn on qualifying purchases.
Limits of Rust-to-C Translation
The report does not establish how much of Rust Eurydice supports, how broadly it has been tested, or whether its generated C has been accepted in particular certification or verification processes. It says some post-quantum cryptography routines have been compiled, but gives no further details about the routines, validation results or deployment status.
Some Rust features require substantial translation. Iterator-based loops may become C while loops that use Eurydice support code to track iterator state. Rust generics also have no direct equivalent in C, so Eurydice must monomorphize generic code, potentially producing multiple versions of a function where an idiomatic C implementation might use macros or void pointers.
Dynamically sized types pose a further challenge. Rust can distinguish cases where a type’s size is known from cases where it is not, and that difference can affect whether bounds checks are needed. Eurydice emits separate C representations for some such types; conversions between them are a runtime no-op but technically violate C’s strict-aliasing rule. The report relays Protzenko’s recommendation to use -fno-strict-aliasing. It does not specify what other compiler settings or review practices users may need.
As an affiliate, we earn on qualifying purchases.
Further Testing and Tool Support
The report does not announce a release date, adoption milestone or scheduled next step for Eurydice. The project is maintained within the Aeneas effort and accepts outside contributions, according to LWN. For prospective users, the next practical questions are how well Eurydice handles their Rust code, whether the resulting C integrates with their existing analysis tools, and how they will validate the translation.
Broader use in high-assurance software would depend on evidence that generated code preserves the properties those projects need and can be assessed within their existing processes. Until more details on support, testing and real-world deployment are available, Eurydice is best understood as a developing bridge between Rust code and C-oriented tooling, not as proof that all Rust programs can be translated directly into acceptable C.
high-assurance cryptography software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Eurydice?
Eurydice is a project that translates Rust code into C while aiming to preserve the program’s structure. It is part of the Aeneas effort, which develops tools connected to formal verification of Rust.
Why translate Rust into C?
Some high-assurance projects rely on verification and compliance tools built for C. A Rust-to-C translation may let those projects use Rust code while working with tools that do not yet support Rust directly.
Does Eurydice support every Rust program?
The report does not claim that it does. Features such as iterators, generics and dynamically sized types require special handling, and the extent of Eurydice’s Rust support is not specified.
Is Eurydice-generated C guaranteed to be safe or certified?
No such guarantee or certification is reported. The project aims to preserve relevant code structure and behavior, but users would still need to assess the generated C within their own verification and compliance processes.
What compiler setting does the report mention?
For generated code involving certain dynamically sized types, Jonathan Protzenko recommends compiling with -fno-strict-aliasing, because Eurydice’s representation conversions technically violate C’s strict-aliasing rule.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
