Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated repository rules to notify users about non-reproducible repos. #2593

Merged
merged 3 commits into from
Apr 2, 2024

Conversation

UebelAndre
Copy link
Collaborator

@UebelAndre UebelAndre commented Mar 31, 2024

This change updates rules_rust repository rules to report when the rules are not guaranteed to be reproducible due to missing sha256 values when fetching Rust artifacts. A common case for this is when users request newer versions of Rust than the ones referenced in @rules_rust//rust:known_shas.bzl, thus leading to unnecessary downloads or potential security issues. After this PR, users will see warnings similar to when integrity is omitted from http_archive definitions

DEBUG: Rule 'rust_analyzer_1.77.1_tools' indicated that a canonical reproducible form can be obtained by modifying arguments sha256s = {"rust-src-1.77.1.tar.xz": "ad2064aa4a444ae35d55b8b57bec837b90c4f10fe6d721f8fce86d7a1992f607", "rustc-1.77.1-aarch64-apple-darwin.tar.xz": "8da1814eb8358236e88ceb155e32f0f34bbe71cb19cd9700c7eb40e675738d77"}
DEBUG: Repository rust_analyzer_1.77.1_tools instantiated at:
  /Users/user/rules_rust/WORKSPACE.bazel:7:25: in <toplevel>
  /Users/user/rules_rust/rust/repositories.bzl:202:10: in rust_register_toolchains
  /private/var/tmp/_bazel_user/76282c66b0dfe3c5cb9a230bdc913a52/external/bazel_tools/tools/build_defs/repo/utils.bzl:240:18: in maybe
  /Users/user/rules_rust/rust/repositories.bzl:737:45: in rust_analyzer_toolchain_repository
Repository rule rust_analyzer_toolchain_tools_repository defined at:
  /Users/user/rules_rust/rust/repositories.bzl:705:59: in <toplevel>
DEBUG: Rule 'rust_darwin_aarch64__aarch64-apple-darwin__stable_tools' indicated that a canonical reproducible form can be obtained by modifying arguments sha256s = {"rustc-1.77.1-aarch64-apple-darwin.tar.xz": "8da1814eb8358236e88ceb155e32f0f34bbe71cb19cd9700c7eb40e675738d77", "clippy-1.77.1-aarch64-apple-darwin.tar.xz": "343f125b0c05dd756e71992c04fb5a4a29ce705c50a739d76eb7f38b088103ac", "cargo-1.77.1-aarch64-apple-darwin.tar.xz": "c0249b6c247953cbe3b01e276988b6ca600aeba4e91332cd2ddaa0b7eee4dfb7", "llvm-tools-1.77.1-aarch64-apple-darwin.tar.xz": "dfee0aaed6b24d34362f229f2926e6b1805f2a8ec4a090c7c28837b82a9bdfd1", "rust-std-1.77.1-aarch64-apple-darwin.tar.xz": "3b5b71e40d934de25dcb553b9df28289d38640e6fa2654b42410f4cc8d9bed2a"}
DEBUG: Repository rust_darwin_aarch64__aarch64-apple-darwin__stable_tools instantiated at:
  /Users/user/rules_rust/WORKSPACE.bazel:7:25: in <toplevel>
  /Users/user/rules_rust/rust/repositories.bzl:230:14: in rust_register_toolchains
  /private/var/tmp/_bazel_user/76282c66b0dfe3c5cb9a230bdc913a52/external/bazel_tools/tools/build_defs/repo/utils.bzl:240:18: in maybe
  /Users/user/rules_rust/rust/repositories.bzl:1043:61: in rust_repository_set
  /Users/user/rules_rust/rust/repositories.bzl:601:36: in rust_toolchain_repository
Repository rule rust_toolchain_tools_repository defined at:
  /Users/user/rules_rust/rust/repositories.bzl:475:50: in <toplevel>

The above was produced by running bazel test //... after applying the following diff:

diff --git a/rust/private/common.bzl b/rust/private/common.bzl
index 52728fe7..c035ad5a 100644
--- a/rust/private/common.bzl
+++ b/rust/private/common.bzl
@@ -31,7 +31,7 @@ load(":providers.bzl", "CrateGroupInfo", "CrateInfo", "DepInfo", "DepVariantInfo
 #
 # Note: Code in `.github/workflows/crate_universe.yaml` looks for this line, if
 # you remove it or change its format, you will also need to update that code.
-DEFAULT_RUST_VERSION = "1.77.0"
+DEFAULT_RUST_VERSION = "1.77.1"

 DEFAULT_NIGHTLY_ISO_DATE = "2024-03-21"

closes #1825

@UebelAndre UebelAndre marked this pull request as draft March 31, 2024 15:45
@UebelAndre UebelAndre marked this pull request as ready for review March 31, 2024 20:45
Copy link
Collaborator

@illicitonion illicitonion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thanks!

@illicitonion illicitonion added this pull request to the merge queue Apr 2, 2024
Merged via the queue into bazelbuild:main with commit f9626f9 Apr 2, 2024
3 checks passed
@UebelAndre UebelAndre deleted the repository branch April 2, 2024 17:02
fmeum pushed a commit to bazel-contrib/toolchains_llvm that referenced this pull request Apr 2, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [rules_rust](https://togithub.com/bazelbuild/rules_rust) |
http_archive | patch | `0.41.0` -> `0.41.1` |

---

### Release Notes

<details>
<summary>bazelbuild/rules_rust (rules_rust)</summary>

###
[`v0.41.1`](https://togithub.com/bazelbuild/rules_rust/releases/tag/0.41.1)

[Compare
Source](https://togithub.com/bazelbuild/rules_rust/compare/0.41.0...0.41.1)

### 0.41.1

```python
load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
    name = "rules_rust",
    integrity = "sha256-mUV3N2A8ORVVZbrm3O9yepAe/Kv4MD2ob9YQhB8aOI8=",
    urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.41.1/rules_rust-v0.41.1.tar.gz"],
)
```

Additional documentation can be found at:
https://bazelbuild.github.io/rules_rust/#setup

#### What's Changed

- Add extra_rustc_flags_for_crate_types. by
[@&#8203;granaghan](https://togithub.com/granaghan) in
[bazelbuild/rules_rust#2431
- Android jobs should be using LTS Bazel releases by
[@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2589
- BUG-FIX: host-triple str for bzl mod by
[@&#8203;ericmcbride](https://togithub.com/ericmcbride) in
[bazelbuild/rules_rust#2587
- fix(cargo-bazel): ignore example crates when checking if proc-macro by
[@&#8203;qtica](https://togithub.com/qtica) in
[bazelbuild/rules_rust#2596
- Deprecated `rust_bindgen.leak_symbols` by
[@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2590
- Update test metadata for crate_universe by
[@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2599
- Fixed bug where crate_universe could match aliases to bench/example
deps by [@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2600
- Cleanup splicing utils by
[@&#8203;dzbarsky](https://togithub.com/dzbarsky) in
[bazelbuild/rules_rust#2564
- Updated repository rules to notify users about non-reproducible repos.
by [@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2593
- feat: Strip debug info from opt builds by
[@&#8203;matte1](https://togithub.com/matte1) in
[bazelbuild/rules_rust#2513
- Release 0.41.1 by
[@&#8203;UebelAndre](https://togithub.com/UebelAndre) in
[bazelbuild/rules_rust#2592

#### New Contributors

- [@&#8203;qtica](https://togithub.com/qtica) made their first
contribution in
[bazelbuild/rules_rust#2596
- [@&#8203;matte1](https://togithub.com/matte1) made their first
contribution in
[bazelbuild/rules_rust#2513

**Full Changelog**:
bazelbuild/rules_rust@0.41.0...0.41.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/bazel-contrib/toolchains_llvm).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Rust toolchain repositories don't warn on missing sha256
2 participants