Rust essentially puts some parts of MISRA into the type checker (e.g. no pointer arithmetic). Why is MISRA bad?
I expect something like MISRA for Rust as well. There will probably be rules like "keyword unsafe forbidden". If you really need it, try writing a deviation record. The advantage is that Rust should require fewer rules.
I've seen code that solves it using a `retval` variable, a typical case of code that is written to avoid breaking MISRA rules instead reimplementing the problem that the MISRA rule tries to avoid except with less idiomatic code and more bugs.
I do web backend stuff. A coworker of mine writes Go according to MISRA C style and this is the main thing that's always annoyed me: it seems like half the codebase is comments justifying deviations, like explicitly commenting when we are using the `if err != nil...` idiom to note any deferred cleanup that takes place and justify why it's safe to early return.
To be fair this matches up well with Rust's general error management style. Everything seems to add another level of nesting, and often adding another function isn't worth the pain of the borrow checker for local vars.
Frankly it makes code worse a lot of the time, that's been my experience anyway. It's probably necessary if you adhere to not using goto and need cleanup code in a function, but otherwise I've seen code trying to adhere to one exit point create bugs. Linux coding standards are the pragmatic choice, use cleanup goto's. They're idiomatic, clear, safe, easy when done right.
I expect something like MISRA for Rust as well. There will probably be rules like "keyword unsafe forbidden". If you really need it, try writing a deviation record. The advantage is that Rust should require fewer rules.