feat: update to Rust 1.96#2680
Merged
Merged
Conversation
Contributor
Summary by CodeRabbit
WalkthroughThe pull request advances the pinned stable Rust toolchain from ChangesRust 1.96.0 Toolchain Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~4 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pull-request-2680.docs.buildwithfern.com/infra-controller |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
dev/docker/Dockerfile.cargo-docker-minimal (1)
7-12:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate stale toolchain comment to match the bumped base image.
Line 7 still says Rust 1.90, but Line 12 now uses
rust:1.96.0-slim-bookworm. Please align the comment to prevent version-drift confusion.Suggested patch
-# Matches rust-toolchain.toml (Rust 1.90). +# Matches rust-toolchain.toml (Rust 1.96).As per coding guidelines,
**/Dockerfile*: "Review Dockerfiles for reproducible builds, minimal runtime surface, correct user/permissions, cache behavior, architecture support, and avoiding embedded secrets."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@dev/docker/Dockerfile.cargo-docker-minimal` around lines 7 - 12, The comment at line 7 stating "Matches rust-toolchain.toml (Rust 1.90)" is outdated and does not reflect the actual Rust version specified in the FROM instruction on line 12 which uses rust:1.96.0-slim-bookworm. Update the comment to change the version reference from 1.90 to 1.96.0 to keep the documentation in sync with the actual base image version being used.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/manuals/cargo-via-docker-macos.md`:
- Around line 11-17: In the "What's in place" table, the row containing "This
guide" references an incorrect file path
`docs/development/cargo-via-docker-macos.md`. Update this path to
`docs/manuals/cargo-via-docker-macos.md` to match the actual location of this
guide file, ensuring readers can navigate to the correct location.
---
Outside diff comments:
In `@dev/docker/Dockerfile.cargo-docker-minimal`:
- Around line 7-12: The comment at line 7 stating "Matches rust-toolchain.toml
(Rust 1.90)" is outdated and does not reflect the actual Rust version specified
in the FROM instruction on line 12 which uses rust:1.96.0-slim-bookworm. Update
the comment to change the version reference from 1.90 to 1.96.0 to keep the
documentation in sync with the actual base image version being used.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b9948992-f617-45c8-b7bb-bc9f5b1b5911
📒 Files selected for processing (13)
.github/actions/setup-mkosi-environment/action.yml.github/workflows/build-boot-artifacts.ymlMakefile.tomlcrates/bmc-proxy/src/setup.rsdev/docker/Dockerfile.build-artifacts-container-aarch64dev/docker/Dockerfile.build-artifacts-container-cross-aarch64dev/docker/Dockerfile.build-artifacts-container-x86_64dev/docker/Dockerfile.build-container-aarch64dev/docker/Dockerfile.build-container-x86_64dev/docker/Dockerfile.cargo-docker-minimaldocs/manuals/cargo-via-docker-macos.mdlints/carbide-lints/rust-toolchain.tomlrust-toolchain.toml
💤 Files with no reviewable changes (1)
- crates/bmc-proxy/src/setup.rs
🔍 Container Scan Summary
Per-CVE detail lives in the per-service |
chet
approved these changes
Jun 18, 2026
osu
approved these changes
Jun 19, 2026
Member
|
Hello, quick question @rwthompsonii: are these two Rust 1.95.0 intentional kept at this ver., or should they be updated to 1.96.0?
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
crates/dpf/dev/Dockerfile.carbide-dpf-api-harness-glibc2.34 (1)
25-35: Implement secure, deterministic Rust installation in dev Dockerfile.Line 33 pipes a remote installer script directly without verification (
curl ... | sh), undermining reproducibility and supply-chain integrity. Harden the installation by downloading a pinnedrustup-initartifact and verifying its checksum before execution. Additionally, pin the base image digest to eliminate mutation from upstream image updates.Proposed hardening pattern
-FROM ubuntu:22.04 AS builder +FROM ubuntu:22.04@sha256:<pinned_digest> AS builderRUN apt-get update && \ DEBIAN_FRONTEND=noninteractive apt-get install -y \ curl \ @@ -32,7 +32,11 @@ ca-certificates \ git \ - && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.96.0 \ + && curl --proto '=https' --tlsv1.2 -fsSLo /tmp/rustup-init https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init \ + && echo "<sha256_of_rustup_init> /tmp/rustup-init" | sha256sum -c - \ + && chmod +x /tmp/rustup-init \ + && /tmp/rustup-init -y --default-toolchain 1.96.0 \ + && rm -f /tmp/rustup-init \ && apt-get clean \ && rm -rf /var/lib/apt/lists/*-FROM ubuntu:22.04 +FROM ubuntu:22.04@sha256:<pinned_digest>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/dpf/dev/Dockerfile.carbide-dpf-api-harness-glibc2.34` around lines 25 - 35, The Dockerfile uses an unsafe pattern of piping a remote installer script directly with curl | sh, which lacks verification and reproducibility. Replace the curl piped installation line with a secure approach: download a specific pinned version of the rustup-init binary, verify its checksum before execution, and then run the installer. Additionally, pin the base image to a specific digest hash (at the FROM statement at the beginning of the file) instead of using just the tag, to prevent mutations from upstream image updates and ensure deterministic builds.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@crates/dpf/dev/Dockerfile.carbide-dpf-api-harness-glibc2.34`:
- Around line 25-35: The Dockerfile uses an unsafe pattern of piping a remote
installer script directly with curl | sh, which lacks verification and
reproducibility. Replace the curl piped installation line with a secure
approach: download a specific pinned version of the rustup-init binary, verify
its checksum before execution, and then run the installer. Additionally, pin the
base image to a specific digest hash (at the FROM statement at the beginning of
the file) instead of using just the tag, to prevent mutations from upstream
image updates and ensure deterministic builds.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ba801b96-5ee5-46b5-a671-81fff1eba88c
📒 Files selected for processing (4)
Makefile.tomlcrates/dpf/dev/Dockerfile.carbide-dpf-api-harness-glibc2.34dev/docker/Dockerfile.cargo-docker-minimaldev/docker/Dockerfile.pxe-build-container
✅ Files skipped from review due to trivial changes (2)
- dev/docker/Dockerfile.pxe-build-container
- Makefile.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- dev/docker/Dockerfile.cargo-docker-minimal
Closed
osu
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issues
Type of Change
Breaking Changes
Testing
Additional Notes