From c9e9dd21f77165f0c20dad098768d2e36e85cd32 Mon Sep 17 00:00:00 2001 From: Pietro Albini Date: Tue, 10 Jan 2023 16:06:19 +0100 Subject: [PATCH 1/3] disable fast submodule checkout due to spurious ci failures --- src/ci/scripts/checkout-submodules.sh | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/ci/scripts/checkout-submodules.sh b/src/ci/scripts/checkout-submodules.sh index f6cb8f8a6da65..5bb343241aea6 100755 --- a/src/ci/scripts/checkout-submodules.sh +++ b/src/ci/scripts/checkout-submodules.sh @@ -36,7 +36,8 @@ function fetch_github_commit_archive { rm $cached } -included="src/llvm-project src/doc/book src/doc/rust-by-example" +#included="src/llvm-project src/doc/book src/doc/rust-by-example" +included="" modules="$(git config --file .gitmodules --get-regexp '\.path$' | cut -d' ' -f2)" modules=($modules) use_git="" @@ -60,9 +61,9 @@ done retry sh -c "git submodule deinit -f $use_git && \ git submodule sync && \ git submodule update -j 16 --init --recursive --depth 1 $use_git" -STATUS=0 -for pid in ${bg_pids[*]} -do - wait $pid || STATUS=1 -done -exit ${STATUS} +#STATUS=0 +#for pid in ${bg_pids[*]} +#do +# wait $pid || STATUS=1 +#done +#exit ${STATUS} From ebf230fb623957558f05aae48d6b444c27cb5679 Mon Sep 17 00:00:00 2001 From: Pietro Albini Date: Tue, 10 Jan 2023 13:10:23 +0100 Subject: [PATCH 2/3] bump Cargo submodule to fix CVE-2022-46176 --- Cargo.lock | 61 +++++++++++++++++++++++++++++++++++++++---------- src/tools/cargo | 2 +- 2 files changed, 50 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 844cf99b4688d..6a15105805eb3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -188,6 +188,12 @@ dependencies = [ "rustc-demangle", ] +[[package]] +name = "base64" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" + [[package]] name = "bitflags" version = "1.3.2" @@ -297,6 +303,7 @@ name = "cargo" version = "0.68.0" dependencies = [ "anyhow", + "base64", "bytesize", "cargo-platform 0.1.2", "cargo-test-macro", @@ -314,6 +321,7 @@ dependencies = [ "git2-curl", "glob", "hex 0.4.2", + "hmac", "home", "http-auth", "humantime 2.0.1", @@ -343,6 +351,7 @@ dependencies = [ "serde-value", "serde_ignored", "serde_json", + "sha1", "shell-escape", "snapbox", "strip-ansi-escapes", @@ -1000,11 +1009,12 @@ dependencies = [ [[package]] name = "crypto-common" -version = "0.1.2" +version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a4600d695eb3f6ce1cd44e6e291adceb2cc3ab12f20a33777ecd0bf6eba34e06" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" dependencies = [ "generic-array", + "typenum", ] [[package]] @@ -1107,12 +1117,13 @@ checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8" [[package]] name = "digest" -version = "0.10.2" +version = "0.10.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8cb780dce4f9a8f5c087362b3a4595936b2019e7c8b30f2c3e9a7e94e6ae9837" +checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f" dependencies = [ "block-buffer", "crypto-common", + "subtle", ] [[package]] @@ -1631,9 +1642,9 @@ dependencies = [ [[package]] name = "git2" -version = "0.15.0" +version = "0.16.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2994bee4a3a6a51eb90c218523be382fd7ea09b16380b9312e9dbe955ff7c7d1" +checksum = "be36bc9e0546df253c0cc41fd0af34f5e92845ad8509462ec76672fac6997f5b" dependencies = [ "bitflags", "libc", @@ -1646,9 +1657,9 @@ dependencies = [ [[package]] name = "git2-curl" -version = "0.16.0" +version = "0.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ed817a00721e2f8037ba722e60358d4956dae9cca10315fc982f967907d3b0cd" +checksum = "7577f4e6341ba7c90d883511130a45b956c274ba5f4d205d9f9da990f654cd33" dependencies = [ "curl", "git2", @@ -1749,6 +1760,15 @@ version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "644f9158b2f133fd50f5fb3242878846d9eb792e445c893805ff0e3824006e35" +[[package]] +name = "hmac" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" +dependencies = [ + "digest", +] + [[package]] name = "home" version = "0.5.3" @@ -2133,9 +2153,9 @@ dependencies = [ [[package]] name = "libgit2-sys" -version = "0.14.0+1.5.0" +version = "0.14.1+1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47a00859c70c8a4f7218e6d1cc32875c4b55f6799445b842b0d8ed5e4c3d959b" +checksum = "4a07fb2692bc3593bda59de45a502bb3071659f2c515e28c71e728306b038e17" dependencies = [ "cc", "libc", @@ -4779,6 +4799,17 @@ dependencies = [ "digest", ] +[[package]] +name = "sha1" +version = "0.10.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3" +dependencies = [ + "cfg-if 1.0.0", + "cpufeatures", + "digest", +] + [[package]] name = "sha2" version = "0.10.1" @@ -5036,6 +5067,12 @@ dependencies = [ "syn", ] +[[package]] +name = "subtle" +version = "2.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601" + [[package]] name = "syn" version = "1.0.102" @@ -5403,9 +5440,9 @@ dependencies = [ [[package]] name = "typenum" -version = "1.12.0" +version = "1.16.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33" +checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba" [[package]] name = "ucd-parse" diff --git a/src/tools/cargo b/src/tools/cargo index f6e737b1e3386..8ecd4f20a9efb 160000 --- a/src/tools/cargo +++ b/src/tools/cargo @@ -1 +1 @@ -Subproject commit f6e737b1e3386adb89333bf06a01f68a91ac5306 +Subproject commit 8ecd4f20a9efb626975ac18a016d480dc7183d9b From 7c58986bbeeef6b7f349a2902b89d2f6e58aba80 Mon Sep 17 00:00:00 2001 From: Pietro Albini Date: Tue, 10 Jan 2023 17:57:02 +0100 Subject: [PATCH 3/3] add subtle dependency --- src/tools/tidy/src/deps.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/tools/tidy/src/deps.rs b/src/tools/tidy/src/deps.rs index ff7a219d9bd85..296db9dfb3da9 100644 --- a/src/tools/tidy/src/deps.rs +++ b/src/tools/tidy/src/deps.rs @@ -50,6 +50,7 @@ const EXCEPTIONS: &[(&str, &str)] = &[ ("similar", "Apache-2.0"), // cargo (dev dependency) ("normalize-line-endings", "Apache-2.0"), // cargo (dev dependency) ("dissimilar", "Apache-2.0"), // rustdoc, rustc_lexer (few tests) via expect-test, (dev deps) + ("subtle", "BSD-3-Clause"), // cargo ]; const EXCEPTIONS_CRANELIFT: &[(&str, &str)] = &[ @@ -219,6 +220,7 @@ const PERMITTED_RUSTC_DEPENDENCIES: &[&str] = &[ "snap", "stable_deref_trait", "stacker", + "subtle", "syn", "synstructure", "tempfile",