openssl/openssl2026-08-01method 2.0
Rust adoption decisionRust 采用决策 · C · TLS and crypto library · 808,625 lines of C · 6,357 exported ABI symbolsC · TLS 与密码学库 · 808,625 行 C · 6,357 个导出 ABI 符号
STAY
stay while the one missing document gets produced先不动，把缺的那份文档做出来
Authorization授权 · DEFER–MEASURE

The requirement holds. The mechanism is the textbook one: C parsing attacker-controlled DER at a network trust boundary. What nobody has published is OpenSSL's advisory history split by component and root cause, so "rewrite the 16,350 lines of crypto/asn1" and "rewrite all 808,625" rest on identical evidence — none. And no proposed scope has a delivery plan for 6,357 exported symbols and a checksum-pinned FIPS module.需求成立。机制也是教科书式的：C 代码在网络信任边界上解析攻击者可控的 DER。真正缺的那份东西没有人公开过，就是按组件和根因拆开的 OpenSSL advisory 历史。于是「重写 crypto/asn1 那 16,350 行」和「把 808,625 行全部重写」靠的是同一份证据，也就是没有证据。而且到目前为止，没有哪个提案为 6,357 个导出符号和被 checksum 锁定的 FIPS 模块给出过交付方案。

INDETERMINATE by construction: nobody has produced the evidence that would settle it. Two documents reopen the decision. First, the advisory history split by component and by eliminated-by-construction / downgraded-to-safe-failure / language-independent. Second, a FIPS impact analysis for the candidate component. If the class concentrates in the decoders, the authorized scope becomes EXTRACT behind the existing ABI — never MIGRATE.INDETERMINATE 是结构性的：能给出结论的证据还没有人做出来。两份文档可以重开这个决策。第一份，把 advisory 历史按组件、并按 eliminated-by-construction / downgraded-to-safe-failure / language-independent 拆开。第二份，候选组件的 FIPS 影响分析。如果这类缺陷确实集中在解析器上，被授权的范围就是在现有 ABI 后面做 EXTRACT，而不会是 MIGRATE。

Scope范围 no Rust scope authorized until the component attribution exists组件归因文档出现之前，不授权任何 Rust 范围 Confidence置信度 LOW Robustness稳健性 INDETERMINATE security-parser · library under a checksum-pinned FIPS validation boundary安全解析器 · 处在 checksum 锁定的 FIPS 验证边界内的库
Exported ABI symbols导出 ABI 符号
6,357symbols个
util/libcrypto.num 5,729 + util/libssl.num 628util/libcrypto.num 5,729 + util/libssl.num 628
Attacker-facing decoders面向攻击者的解析器
49,844lines行
crypto/asn1 + crypto/x509 .c · 6.2% of the .c totalcrypto/asn1 + crypto/x509 的 .c · 占 .c 总量 6.2%
Hand-tuned asm generators手写汇编生成器
257,523lines行
crypto/**/asm/*.pl · 213 perlasm filescrypto/**/asm/*.pl · 213 个 perlasm 文件
FIPS moduleFIPS 模块
checksumpinned已锁定
providers/fips-sources.checksums · validation boundaryproviders/fips-sources.checksums · 验证边界
Candidate scope spread候选范围跨度
16,350–808,625lines行
why robustness is INDETERMINATErobustness 判为 INDETERMINATE 的原因
In-repo test material仓库内测试代码
214,064lines行
test/ .c and .h · 342 filestest/ 的 .c 与 .h · 342 个文件

01The options备选方案

Same objective for every option: eliminate the memory-unsafety class where OpenSSL decodes attacker-controlled input, without breaking the exported ABI or the FIPS validation.所有方案的目标一致：在 OpenSSL 解析攻击者可控输入的地方消除内存不安全这一缺陷类，同时不破坏导出 ABI 与 FIPS 验证。

Option方案Scope范围Benefit收益Cost成本Time to value见效时间Compatibility / rollback兼容 / 回滚Evidence证据
Stay and publish the attribution先不动，把归因发出来recommended · the cheapest way to make any later option decidable推荐 · 让后续任何方案变得可判定的最便宜做法STAYno risk reduction yet; unblocks the decision暂时不降低风险；但让决策能做weeks of analysis; no recurring数周分析；无经常性成本weeks数周unchanged · nothing to roll back不变 · 没有要回滚的东西STRONG
Continue fuzzing, review and hardening继续 fuzzing、评审与加固retain · the funded baseline any Rust option must beat保留 · 有预算的基线，任何 Rust 方案都要赢过它STAYreduces incidence, class stays reachable降低发生率，但这类缺陷仍然可达none new; existing budget无新增；用现有预算already running已经在跑native · no risk原生 · 无风险MODERATE
Rust DER/X.509 decoder behind the ABIABI 后面的 Rust DER/X.509 解析器retain · the likely answer if the attribution lands where structure suggests保留 · 如果归因落在结构所指的位置，答案大概就是它EXTRACTclass removed in 6.2% of the .c tree, if that is where it lives在 .c 树的 6.2% 里消除该缺陷类，前提是缺陷确实住在那里unpriced; Rust toolchain everywhere未定价；每个平台都要带 Rust 工具链unknown未知same ABI · flag-selectable if dual-builtABI 不变 · 双构建时可用编译开关切换UNKNOWN
Rewrite OpenSSL in Rust用 Rust 重写 OpenSSLexclude · fails G4 outright排除 · 直接卡死在 G4MIGRATEclass removed; no evidence it beats the extraction该缺陷类消失；但没有证据说明它优于抽取方案multi-year; FIPS re-validation以年计；外加 FIPS 重新验证years以年计entire ABI + validation · no rollback整个 ABI 加验证 · 无回滚WEAK
Consumers adopt a Rust TLS stack使用方改用 Rust TLS 栈retain · demonstrably works — see curl's shipped rustls backend保留 · 已经被跑通，见 curl 已发布的 rustls 后端ADOPTfull class removal for that consumer's TLS path该使用方的 TLS 路径上整类缺陷消失per consumer; narrower coverage按使用方计；覆盖面更窄weeks per project每个项目数周different API · caller-side rollbackAPI 不同 · 回滚在调用方手里STRONG

02Evidence ledger证据账本

States are evidence about named options, not points to be added up. D6 is UNKNOWN and stays UNKNOWN here. It sits under the two gates that decide this case, and no amount of argument closes it.状态是针对具体方案的证据，不能相加成分数。D6 是 UNKNOWN，这里就照写 UNKNOWN。决定本案的两道门都压在它上面，靠论证关不上。

D1 · Requirement & ownership需求与归属
SUPPORTS · rust optionsSTRONG
OpenSSL owns 808,625 lines of C. Of that, 49,844 lines decode attacker-supplied ASN.1 and X.509 structures and 115,280 terminate untrusted TLS records.OpenSSL 自己维护 808,625 行 C。其中 49,844 行解析攻击者提供的 ASN.1 与 X.509 结构，115,280 行负责终结不受信任的 TLS 记录。
crypto/asn1 65 .c files · crypto/x509 98 .c files · ssl/ 115 .c and .h files
D2 · End-to-end reach端到端影响
N/ASTRONG
Nobody has asserted a performance requirement here. No Amdahl figure appears: a line share is not a time share, and inventing one would be a method error.本案没有人提出性能要求。这里不给 Amdahl 数字：行数占比不等于时间占比，硬造一个属于方法错误。
objective is safety, not latency
D3 · Tail & runtime尾延迟与运行时
N/ASTRONG
No managed runtime or collector exists in the library, so no runtime mechanism is present in any tail.库里没有托管运行时，也没有 GC，所以尾部时延里不存在运行时机制这一项。
C library, no GC
D4 · Fleet footprint机队占用
N/ASTRONG
The library runs inside the caller's process; this decision changes no fleet density or instance count.库跑在调用方的进程里。这个决策不改变任何机队密度或实例数量。
embedded linkage model
D5 · Startup shape启动形态
N/ASTRONG
Handshake round-trips dominate connection setup; library initialization is not a stated constraint here.连接建立的时间由握手往返主导。本案没有把库初始化列为约束。
no startup requirement asserted
D6 · Safety & correctness安全与正确性
UNKNOWN · rust optionsUNKNOWN
The classification this decision needs does not exist publicly: advisories split per component into eliminated-by-construction, downgraded-to-safe-failure and language-independent. Counting advisories is not a causal argument.这项决策需要的分类在公开渠道里不存在：按组件把 advisory 拆成 eliminated-by-construction、downgraded-to-safe-failure、language-independent 三类。只数 advisory 的条数，构不成因果论证。
no published per-component root-cause attribution
D7 · Concurrency & invariants并发与不变量
NEUTRAL · allMODERATE
Thread safety is already a contract, carried by the library's own locking and init APIs. No option encodes those invariants better without changing the contract.线程安全已经写进契约，由库自己的加锁与初始化 API 承担。在不改契约的前提下，没有哪个方案能把这些不变量表达得更好。
crypto/threads_*.c · documented threading model
D8 · Distribution分发
DISFAVORS · rust optionsMODERATE
OpenSSL is a system dependency on platforms where a C compiler is the only guaranteed toolchain. Putting Rust in the build narrows that set, and it lands on every distributor.在一些平台上 OpenSSL 是系统依赖，而那里唯一有保证的工具链就是 C 编译器。把 Rust 加进构建会缩小这个平台集合，而且每一个发行方都要跟着动。
Configure · config · Configurations/ platform matrix
D9 · Ecosystem & alternatives生态与替代方案
SUPPORTS · adopt-rust-tlsSTRONG
Production Rust TLS stacks exist and major C consumers already ship them, so the adoption path is demonstrated rather than hypothetical.生产级 Rust TLS 栈已经存在，主要的 C 使用方也已经把它发布出去了。所以这条采用路径是有人走通的，不是设想。
curl ships lib/vtls/rustls.c (1,468 lines) as a selectable backend
D10 · Boundary & compatibility边界与兼容性
DISFAVORS · rust-fullSTRONG
The compatibility surface is 5,729 libcrypto plus 628 libssl exported symbols across 144 public headers. Callers branch on the error semantics, so those are part of the surface too.兼容面是 144 个公开头文件里的 5,729 个 libcrypto 符号加 628 个 libssl 符号。调用方还会拿错误语义做分支判断，所以错误语义也算在这个面里。
util/libcrypto.num · util/libssl.num · include/openssl/ 116 .h + 28 .h.in
D11 · Delivery economics交付经济性
DISFAVORS · rust-fullSTRONG
The FIPS provider ships with a checksummed source manifest. Replacing validated code is a re-validation project, not a refactor. Separately, 257,523 lines of perlasm generate the hand-tuned assembly that carries the library's performance and none of its safety objective.FIPS provider 附带一份带 checksum 的源码清单。替换已验证的代码，走的是重新验证流程，重构那套做法覆盖不了。另外，257,523 行 perlasm 生成的是手写汇编，它们扛着库的性能，和安全目标无关。
providers/fips-sources.checksums · providers/fips.checksum · crypto/**/asm/*.pl (213 files)
D12 · Counterfactual反事实基线
SUPPORTS · c-harden, adopt-rust-tlsMODERATE
Two funded alternatives already run. Inside OpenSSL, continuous fuzzing and review. Outside it, consumer-side adoption of a Rust TLS stack. Both have to be beaten, not assumed away.已经有两个带预算的替代方案在跑。OpenSSL 内部是持续 fuzzing 和代码评审，外部是使用方自己换成 Rust TLS 栈。这两个都得赢过，不能当它们不存在。
existing OpenSSL security process · curl's shipped rustls backend

N/A lenses: D3 tail latency, D4 fleet footprint and D5 startup shape have no bearing on a memory-safety objective for a library that runs inside the caller's process.判为 N/A 的维度：D3 尾延迟、D4 机队占用、D5 启动形态。对一个跑在调用方进程里的库来说，它们与内存安全目标无关。

03What decided it决定性证据

The document this decision needs does not exist这项决策需要的那份文档不存在

Picking a Rust scope means knowing which components produced OpenSSL's memory-safety advisories, and which of those Rust would have eliminated by construction. Nobody has published that classification. So every scope from 16,350 lines to 808,625 rests on the same evidence.要选定 Rust 的范围，就得知道 OpenSSL 的内存安全 advisory 各自出自哪个组件，其中哪些是 Rust 能从构造上直接消除的。这份分类没有人公开过。于是从 16,350 行到 808,625 行，每一个候选范围拿到的都是同一份证据。

no public per-component root-cause attribution

The compatibility surface is 6,357 exported symbols兼容面就是这 6,357 个导出符号

util/libcrypto.num lists 5,729 exported symbols; util/libssl.num adds 628. They span 144 public headers. A rewrite owes every one of them, down to the error semantics callers branch on.util/libcrypto.num 列了 5,729 个导出符号，util/libssl.num 再加 628 个，分布在 144 个公开头文件里。重写要对其中每一个负责，细到调用方拿来做分支的错误语义。

util/libcrypto.num · util/libssl.num · include/openssl/

The FIPS module's sources are checksum-pinnedFIPS 模块的源码被 checksum 锁死

The pinning is literal. providers/ ships fips-sources.checksums, fips.checksum and fips.module.sources. Replacing validated source starts a re-validation project on a regulatory calendar, which is a different kind of cost from engineering effort.这个锁定是字面意义上的。providers/ 里带着 fips-sources.checksums、fips.checksum 和 fips.module.sources。替换已验证的源码，等于启动一个受监管日历约束的重新验证项目，这类成本和工程投入不是一回事。

providers/fips-sources.checksums · providers/fips.module.sources

257,523 lines of perlasm are not part of the safety objective257,523 行 perlasm 不在安全目标之内

The hand-tuned assembly generators carry the library's throughput. A memory-safety rewrite has no reason to touch them. It cannot inherit them either. "Rewrite OpenSSL" and "make OpenSSL safe" are two different projects.这些手写汇编生成器扛着库的吞吐。以内存安全为目标的重写没有理由去动它们，也继承不了它们。「重写 OpenSSL」和「让 OpenSSL 安全」是两个项目。

crypto/**/asm/*.pl · 213 files

The attacker-facing decoders are 6.2% of the .c tree面向攻击者的解析器占 .c 树的 6.2%

crypto/asn1 and crypto/x509 come to 49,844 of 808,625 lines of .c. Two directories. If the class concentrates where the structure suggests, the authorized scope is an extraction roughly sixteen times smaller than the proposal usually made.crypto/asn1 加 crypto/x509 一共 49,844 行，而 .c 总量是 808,625 行。两个目录。如果这类缺陷确实集中在结构所指的位置，那么被授权的范围是一次抽取，规模大约是常见提案的十六分之一。

crypto/asn1 16,350 + crypto/x509 33,494 lines of .c

04What Rust buys here, and what it doesn'tRust 在这里买得到什么，买不到什么

Buys买得到

  • Class elimination in decoded input handling解析输入这一段的整类缺陷消失 — a Rust DER/X.509 decoder cannot produce a memory-unsafety defect in its own code, at the exact place attacker bytes arrive first.Rust 写的 DER/X.509 解析器，不可能在自己的代码里产生内存不安全缺陷，而这里正是攻击者字节最先落地的位置。
  • A demonstrated consumer escape hatch使用方有一条已经走通的退路 — callers who need memory-safe TLS today can adopt a Rust stack, as curl already does behind a build flag.今天就需要内存安全 TLS 的调用方，可以直接换 Rust 栈；curl 已经这么做了，用一个编译开关控制。
  • Nothing else, yet目前就这些 — every wider claim in this decision is currently unmeasured, and the report labels it UNKNOWN rather than estimating it.这项决策里更大的主张全都没有测量过。报告把它们标成 UNKNOWN，而不是随手估一个数出来。

Doesn't buy买不到

  • Throughput吞吐 — the performance lives in 257,523 lines of perlasm-generated assembly that a Rust rewrite would have to keep or re-create.性能落在 257,523 行由 perlasm 生成的汇编里。Rust 重写要么把它们留着，要么重造一遍。
  • Relief from the ABI从 ABI 里解脱 — 6,357 exported symbols and their error semantics survive any implementation change; they are the contract, not an implementation detail.6,357 个导出符号连同它们的错误语义，在任何实现变更之后都还在。它们本身就是契约。
  • A shortcut through FIPS绕开 FIPS 的捷径 — the validated module's sources are checksum-pinned; changing them re-opens validation regardless of language.已验证模块的源码被 checksum 锁死。改动它就要重开验证，和用什么语言无关。

05Who has done this before同型先例

curl · rustls backend

EXTRACT SHIPPED

A major C consumer of TLS added a Rust backend as 1,468 lines behind an abstraction that already held six of them, and kept it. The same project pushed Rust deeper into its HTTP internals, and deleted that.一个重量级的 TLS C 使用方，在一个已经有六个后端的抽象层后面，加了 1,468 行的 Rust 后端，并且留了下来。同一个项目把 Rust 往 HTTP 内部推的那次尝试，后来被删掉了。

matches匹配: same trust boundary, same language pair, C caller with a stable ABI同一条信任边界，同一对语言，调用方是带稳定 ABI 的 C · differs不匹配: curl consumes TLS; OpenSSL is the implementation with the exported ABI and FIPS obligationcurl 是 TLS 的使用方；OpenSSL 是实现方，扛着导出 ABI 和 FIPS 义务
first-party · maintainer blog

Google · Android memory-safety program

INCREMENTAL

Memory safety's share of Android vulnerabilities fell from 76% to below 20%. The method was writing new code in safe languages and letting the old C/C++ age out. Google's own data puts five-year-old code at 3.4–7.4× lower vulnerability density than new code.Android 漏洞里内存安全类的占比，从 76% 降到 20% 以下。做法是新代码用安全语言写，旧的 C/C++ 自然老化退场。Google 自己的数据显示，五年前写的代码，漏洞密度比新代码低 3.4–7.4 倍。

matches匹配: same requirement class; the strongest published safety numbers available同一类需求；也是目前公开的安全数据里最强的一组 · differs不匹配: an OS with many entry points, and the figures are C/C++-relative rather than component-attributed那是一个入口众多的操作系统；而且那些数字是相对整体 C/C++ 算的，没有落到具体组件
first-party · vendor security blog

Chromium · memory-safety bug analysis

ATTRIBUTION PUBLISHED

Chromium published the analysis OpenSSL has not. Of 912 high and critical security bugs since 2015, roughly 70% were memory unsafety, about half of those use-after-free. A table like that is what makes a scope decision fundable.Chromium 公布了 OpenSSL 没有公布的那份分析。2015 年以来的 912 个高危与严重安全缺陷中，约 70% 是内存不安全，其中约一半是 use-after-free。有了这样一张表，范围决策才拿得到预算。

matches匹配: demonstrates the exact artifact this decision is missing它正好就是本决策缺的那件东西 · differs不匹配: a browser's bug corpus and component structure differ entirely from a crypto library's浏览器的缺陷样本和组件结构，和密码学库完全不同
first-party · project security page

Mozilla · Stylo

EXTRACT SHIPPED

One Rust component landed inside a large C++ codebase in about two years. The move was to pick a single subsystem with a clean interface. The whole-engine replacement at the same organisation was cancelled.一个 Rust 组件用大约两年时间落进了一个大型 C++ 代码库。关键动作是只挑一个接口干净的子系统。同一家机构里那个整引擎替换项目被取消了。

matches匹配: component-scoped Rust inside a large, ABI-constrained native codebase在一个受 ABI 约束的大型原生代码库里，把 Rust 的范围限定到单个组件 · differs不匹配: no exported C ABI of comparable size and no validation regime那里没有同等规模的导出 C ABI，也没有验证合规体系
first-party · engineer account

06What to do next可逆路径

Publish the advisory attribution把 advisory 归因发出来

The OpenSSL security team, or an independent analyst, turns the advisory history into a table: component, root cause, and one of eliminated-by-construction / downgraded-to-safe-failure / language-independent. Every advisory in the published set gets classified, and the method gets written down with it. If the public advisory text is too thin to classify, stop and say so — that answer is itself the finding. No code moves in this step.由 OpenSSL 安全团队或一位独立分析者，把 advisory 历史整理成一张表：组件、根因，以及 eliminated-by-construction / downgraded-to-safe-failure / language-independent 三选一。公开集合里的每一条 advisory 都要归类，方法也要一并写清楚。如果公开的 advisory 文本不足以支撑分类，就停下来把这一点讲明白，这本身就是结论。这一步不动任何代码。

3–6 weeks3–6 周

Analyse the FIPS impact of the candidate component分析候选组件对 FIPS 的影响

Whoever owns the validated module writes down whether replacing the candidate component's implementation crosses the module boundary, and what re-validation would cost. Two answers pass: "outside the boundary" with evidence, or a calendar and a price for re-validation. If the component sits inside the boundary and re-validation is unfundable, the Rust track stops here. Documentation only.由已验证模块的负责人写清楚两件事：替换候选组件的实现会不会越过模块边界，以及重新验证要花多少。可通过的答案只有两种：有证据地说明「在边界之外」，或者给出重新验证的日历与价格。如果组件落在边界之内、而重新验证的钱拿不出来，Rust 这条线就到此为止。这一步只出文档。

2–4 weeks2–4 周

Prototype one decoder behind the unchanged ABI在不变的 ABI 后面做一个解析器原型

Two engineers who know both C and Rust reimplement the highest-attribution decoder in Rust, exposed through the existing symbols, with a differential-fuzzing harness pointed at the C version. Passing means byte-identical accept/reject decisions and identical error codes on that corpus, plus no measured throughput regression on the library's own test workloads. Ten weeks is the limit. Miss differential parity by then and the divergences get published instead; the C implementation stays the default build and the Rust path stays a disabled build option.两位同时熟悉 C 和 Rust 的工程师，用 Rust 重写归因最高的那个解析器，通过现有符号暴露出去，并配一套对着 C 版本跑的 differential fuzzing。通过的标准是：在那份语料上，接受/拒绝的判定逐字节一致，错误码一致，并且在库自己的测试负载上测不到吞吐回退。上限是十周。到期还没做到对照一致，就把差异公开出来收工；C 实现仍然是默认构建，Rust 路径仍然是默认关闭的构建选项。

6–10 weeks6–10 周

Re-run these gates on the new evidence拿新证据重跑这四道门

OpenSSL maintainers re-run the assessment against the attribution table, the FIPS analysis and the prototype's parity results. It passes when G2 and G3 leave UNKNOWN with citations attached and the selected scope is written down in words. If G2 is still UNKNOWN, authorization stays DEFER–MEASURE however good the prototype looks. Either way the C implementation stays. So does the hardening programme.由 OpenSSL 维护者拿归因表、FIPS 分析和原型的对照结果，把评估重跑一遍。通过的标准是：G2 与 G3 带着引用离开 UNKNOWN，并且用文字写明选定的范围。如果 G2 还停在 UNKNOWN，不管原型做得多好，授权都维持 DEFER–MEASURE。无论如何，C 实现照旧保留，加固计划也照常继续。

1 week1 周

07Arguing both sides对称反证

Against migrating反驳「迁移」

PASSEnd-to-end reach端到端影响 — No performance benefit is claimed here, and no Amdahl number is invented to fill the space. D2 is N/A because the objective is safety.本案不主张性能收益，也没有为了填空造一个 Amdahl 数字。目标是安全，所以 D2 判为 N/A。
HITAttribution归因 — The causal share Rust would capture cannot be located. The per-component root-cause classification is not published, so there is nothing to locate it in.Rust 能吃下的那部分因果份额定位不了。按组件划分的根因分类没有公开，也就没有可供定位的底图。
HITBaseline and regime基线与口径 — Structural line counts are standing in for defect distribution. That is the substitution this method forbids as a basis for authorization.这里是用结构性的行数在顶替缺陷分布。这套方法禁止用这种顶替作为授权依据。
PASSBoundary and compatibility边界与兼容性 — 6,357 exported symbols, 144 public headers, the error semantics and the checksum-pinned FIPS module are all named, and all priced against the full-rewrite option.6,357 个导出符号、144 个公开头文件、错误语义，以及被 checksum 锁死的 FIPS 模块，全都点了名，也全都按整体重写方案算了成本。
HITDelivery ownership交付归属 — No proposed Rust scope names an owner, a dual-run plan or a re-validation calendar. The report withholds authorization rather than assume those will turn up.现在提出的 Rust 范围，没有一个指定了负责人、双跑方案或重新验证日历。报告选择不授权，而不是假定这些东西以后会自己冒出来。

Against staying反驳「不动」

PASSFunded counterfactual有预算的反事实 — Fuzzing and review inside OpenSSL, and Rust-TLS adoption outside it, are both running, both funded, and both recorded here as options.OpenSSL 内部的 fuzzing 与评审，外部使用方改用 Rust TLS，两条路都在跑，都有预算，也都作为方案记录在案。
HITCost of inaction不动的代价 — Staying keeps the memory-unsafety class reachable in 49,844 lines that decode attacker-supplied structures. Nothing here presents staying as the safe choice.不动，就意味着在 49,844 行解析攻击者提供结构的代码里，内存不安全这一类缺陷仍然可达。报告没有把「不动」写成安全的那个选择。
PASSUnsafe-surface omission遗漏的 unsafe 面 — G1 and the mechanism behind G2 are both granted to the Rust options. What the report withholds is scope selection and delivery, not the premise.G1 以及 G2 背后的机制，报告都认给了 Rust 方案。卡住的是范围选择和交付，不是前提。
PASSNative-advantage denial对原生优势的否认 — A shipped Rust TLS integration in another major C project is cited here as working evidence, not waved off.另一个重量级 C 项目里已经发布的 Rust TLS 接入，在这里是当作有效证据引用的，没有被打发掉。
PASSStop condition停止条件 — DEFER–MEASURE names two documents and one prototype, each with an acceptance threshold. "Harden C forever" is not the default outcome.DEFER–MEASURE 点名了两份文档和一个原型，每一项都带验收阈值。所以默认结局不会是「永远加固 C」。

08How this was produced方法与记录

openssl/openssl at cdcb6ad · static read-only analysis · why-not-rust method 2.0openssl/openssl @ cdcb6ad · 只读静态分析 · why-not-rust 方法 2.0

Repository: github.com/openssl/openssl at commit cdcb6ad, shallow clone, 6,152 tracked files. Scope: the whole repository, with crypto/asn1 and crypto/x509 as the candidate extraction components. Sampling: 808,625 lines of C across 1,695 files; and, on a .c-and-.h basis, crypto/ 350,280, ssl/ 115,280, providers/ 87,318 and test/ 214,064. The bases differ. The per-directory figures count .c and .h together, the 808,625 total is .c only, and crypto/asn1 (16,350) and crypto/x509 (33,494) are quoted .c-only so the 6.2% share compares like with like. Exported-symbol manifests were read as one symbol per line: util/libcrypto.num (5,729) and util/libssl.num (628). No build, test, benchmark or network call was run against the project, and no advisory database was ingested; that absence is the gap this report reports. Objective: eliminate the memory-unsafety class where OpenSSL decodes attacker-controlled input without breaking the exported ABI or FIPS validation. User-supplied facts: none. No Amdahl calculation appears; the objective is safety, and substituting a line share for a time share would be a method error. Confidence is LOW and robustness INDETERMINATE by the method's own definitions, because two of the four gates are UNKNOWN and the candidate scopes span two orders of magnitude. This is a structured decision protocol, not a statistical predictor. DEFER–MEASURE here means the evidence to choose does not exist yet. It does not mean Rust cannot help.仓库：github.com/openssl/openssl，commit cdcb6ad，浅克隆，6,152 个受版本控制的文件。范围：整个仓库，候选抽取组件是 crypto/asn1 与 crypto/x509。采样：1,695 个文件、808,625 行 C；按 .c 与 .h 合计的口径，crypto/ 350,280 行，ssl/ 115,280 行，providers/ 87,318 行，test/ 214,064 行。口径不一样。目录级数字是 .c 与 .h 合计，808,625 这个总数只算 .c，crypto/asn1（16,350）与 crypto/x509（33,494）也只算 .c，这样 6.2% 才是同口径比较。导出符号清单按每行一个符号读取：util/libcrypto.num 5,729 个，util/libssl.num 628 个。没有对项目做过任何构建、测试、基准或网络调用，也没有导入任何 advisory 数据库；这份缺失正是本报告要报告的缺口。目标：在 OpenSSL 解析攻击者可控输入的地方消除内存不安全这一缺陷类，同时不破坏导出 ABI 与 FIPS 验证。用户提供的事实：无。本报告不做 Amdahl 计算；目标是安全，用行数占比顶替时间占比属于方法错误。按方法自身的定义，confidence 为 LOW，robustness 为 INDETERMINATE：四道门里有两道停在 UNKNOWN，候选范围跨了两个数量级。这是一套结构化决策协议，不是统计预测器。这里的 DEFER–MEASURE 是说，用来做选择的证据还不存在。它不是说 Rust 帮不上忙。

What we don't know证据缺口What it would change会改变什么
Advisory history split by component and root cause按组件与根因拆分的 advisory 历史The gap that decides the rest. While it is missing, G2 and G3 stay UNKNOWN and no Rust scope gets authorized — including the small one this report thinks is most likely right.决定其余一切的那个缺口。只要它还缺着，G2 和 G3 就停在 UNKNOWN，任何 Rust 范围都拿不到授权，包括报告认为最可能正确的那个小范围。
FIPS boundary impact for the candidate component候选组件对 FIPS 边界的影响If the component sits inside the validated module, re-validation cost may make even the small extraction unfundable, and the answer stays STAY.如果这个组件落在已验证模块之内，重新验证的成本可能连那次小规模抽取都撑不住，结论就仍然是 STAY。
Ownership and dual-run plan for any Rust scope任何 Rust 范围的负责人与双跑方案Without named owners and a rollback path, G4 stays FAIL for every migration option, whatever the attribution turns out to show.没有指名的负责人和回滚路径，G4 对每个迁移方案都停在 FAIL，归因最后查出什么都一样。