Proposal to require Rust to build PDFium

[Lei Zhang]

Hi folks that build PDFium,

This is an informal proposal to make Rust a requirement for building
PDFium. If you have any questions or concerns about this proposal,
please reply.

There are several pieces of third party Rust code that PDFium either
currently use in an optional manner, or will like to start using in
the future:

1) Skia's Rust PNG decoder to replace libpng in test code and
XFA-enabled builds. [1]
2) Fontations to replace FreeType. [2]
3) jxl-rs for JPEG XL support. [3]

Having Rust as a baseline requirement will make build configs easier
to manage and make the above projects easier to accomplish.

More details and additional data points:
- Developers using PDFium's C++ toolchain can just add
`'checkout_rust': True` to .gclient to get PDFium's Rust toolchain on
the next `gclient sync`.
- This does not require end users to install anything new.
- Currently, there are no plans to write first party PDFium code in Rust.
- Chromium added the Rust build requirement just over 2 years ago. [4]

[1] https://crbug.com/458078747
[2] https://crbug.com/42271123
[3] https://crbug.com/482074621
[4] https://groups.google.com/a/chromium.org/g/chromium-dev/c/i2m-4KB_Duw

[geisserml]

If I understand correctly, the idea is that a Rust toolchain would be required even if the build doesn't actually use any of the new Rust libraries per config?
That doesn't sound ideal from a downstream perspective, not unless one of 1,2,3 would actually become mandatory soon.
IMHO, pdfium's checkout and build process is unusually bloated for a PDF library anyway.

[geisserml]

Also, I wanted to ask, is there are chance that we could get use_system_* options for rustpng, fontations and jxl-rs in the future?

[Lei Zhang]

The idea is to make the Rust toolchain mandatory, which is a step
towards making Rust libraries mandatory.

Chrome Security generally sees Rust as a safer language for codec
decoding. As an example, many in the past would have thought libpng
had been picked clean of security bugs. Yet in 2026 libpng had at
least 3 CVEs rated high severity:

CVE-2026-25646
CVE-2026-33416
CVE-2026-33636

Meanwhile, Chromium avoided these vulnerabilities completely by
switching to a Rust-based PNG decoder.

If you see any parts of the code checkout that aren't required or
should be optional, please file issues for them so that can be
addressed.

As Linux distros start packaging Rust-based libraries, PDFium can add
use_system_* options for those who which to not use the bundled copy.

> --
> You received this message because you are subscribed to the Google Groups "pdfium" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to pdfium+un...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/pdfium/5df92f14-c915-41ca-b099-0c11e4e0da3an%40googlegroups.com.

[geisserml]

Thanks for the explanation, I can see the memory safety advantages.
I have no objection to requiring Rust if it is actually required. In case build configs remain that do not need Rust (e.g. because use_system_* options are set for Rust libraries) it would be great if it remained optional though.