[privacy/compile-time]: Building rust/cargo projects may leak the compiler's pc username as full homedir paths are getting compiled in - even in the release (and striped) binaries. (the user supposedly distributes these binaries) Is this intended for some reason?
On Linux I created a fresh user 'johndoe', and I cloned and built the 'cargo' crate with the followings:$ rustup toolchain install stable$ git clone https://github.com/rust-lang/cargo.git$ cd ./cargo$ cargo build --release$ xxd -c 48 ./target/release/cargo | grep --color $USER
You can see the output on the attached picture below. Many '/home/johndoe/...' paths are getting hardcoded in the release build.
As soon as these binaries are distributed, as far as I can tell these hardcoded home dir paths are becoming totally meaningless (?), (do they even provide any benefit when being executed on the compiler's machine?)
However I can see some cases when leaking the compiler's pc username in the distributed binary is not desired (eg. a company protecting employees privacy, or sharing proof-of-concept exploits anonymously, etc.)
Currently I see not other way to prevent this leakage then to create a new pc user with some dummy name, reinstall the whole toolchain with all the hustle, etc. and compile there.
So what is happening here? Is this
\- a known / intentional behavior or
\- an issue that should be reported or
\- something that's just happens to be happening and no one should care?
( Stripping the binary does not remove these compiled-in strings, the following has the same output as above:$ strip -o ./target/release/cargo-striped ./target/release/cargo$ xxd -c 48 ./target/release/cargo-striped | grep --color $USER
Also this is not specific to the 'cargo' crate, all of my home projects show the hardcoded home paths within)
