setup.sh: pin cargo-binstall by version and digest, not curl|bash of main - #342
Merged
Conversation
…main The cargo-binstall bootstrap piped install-from-binstall-release.sh from the upstream repository's main branch straight into bash: the one unpinned, unverified execution path in a script where every other tool is version-pinned. Now the release asset for the host platform is downloaded directly from the v1.21.1 release and verified against scripts/cargo-binstall.sha256 before it runs. A digest mismatch or an unrecorded asset fails closed; platforms without a pinned asset fall back to cargo install --locked (registry checksums). Bumping the version means re-recording the digests deliberately.
lann
enabled auto-merge
August 6, 2026 11:45
This was referenced Aug 6, 2026
lann
added a commit
that referenced
this pull request
Aug 6, 2026
The two wpt-parity-webkit jobs installed just by piping just.systems/install.sh into bash: version-pinned but a floating, unverified script — the same shape #342 removed from setup.sh. The comment's excuse ("this job skips the Rust toolchain, so it cannot use setup.sh's cargo-binstall path") turns out to be false: binstall's prebuilt strategy needs no cargo at all. setup.sh's digest-verified bootstrap moves to scripts/install-binstall.sh, shared by setup.sh and the two jobs, which now install just with cargo-binstall --disable-strategies compile (fail closed rather than presume a toolchain). just's own bytes stay trusted via crates.io metadata + GitHub TLS, like every other binstall-installed tool; byte-pinning the tools themselves is the still-open half of #34.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
scripts/setup.shpiped cargo-binstall'sinstall-from-binstall-release.shfrom the upstream repo'smainbranch straight into bash — the unpinned, unverified execution path #34 calls out ("the cargo-binstall bootstrap iscurl | bashfrom a mutablemainref").Now
install_binstalldownloads the v1.21.1 release asset for the host platform directly (no bootstrap script), verifies it against the committedscripts/cargo-binstall.sha256, and fails closed on a digest mismatch or an unrecorded asset. Platforms without a pinned asset fall back tocargo install --locked --version(registry checksums). Bumping the version means re-recording the digests deliberately. Ported from polymorph-components/polymorph-websocket#30; the digest file is byte-identical.This addresses the pin-the-bootstrap half of #34's third checklist item; the verify-installed-versions-against-the-pins half (and the rest of #34) remains open.
Verification:
~/.cargo/binand reports 1.21.1; this PR's own CI exercises the x86_64 path, since the ci.yml, pages, and timing-lab jobs run./scripts/setup.shunziprestores the exec bit