There are s3 addresses in the Rust 1.14 manifests

[brson]

[pkg.cargo.target.arm-unknown-linux-gnueabi]
available = true
url = "https://s3.amazonaws.com/rust-lang-ci/cargo-builds/298a0127f703d4c2500bb06d309488b92ef84ae1/cargo-nightly-arm-unknown-linux-gnueabi.tar.gz"
hash = "a98891b4d4d7576b544e70b791c2c87887653b9def92e29ac10d5e7323db08f1"

This is incorrect. Every address in the manifest should be from static.rust-lang.org. I don't want to make any guarantees that https://s3.amazonaws.com/rust-lang-ci/cargo-builds will always exist. I believe there is minor functionality in rustup that will break if the manifest contains multiple root URLs.

[brson]

The cargo tarballs mentioned in the manifest also don't have accompanying .asc signatures, which people expect as part of our release process. There are .sha256 files.

Fortunately the cargo hashes are captured in the signed manifest. For this release I will go make the signatures and upload them to the cargo-builds s3 bucket by hand.

cc @rillian

[rillian]

Thanks @brson! I have a packaging script I use to upload new releases to the Firefox build infrastructure and it failed on the missing cargo signatures.

Thanks also for pointing out that the manifest is signed; I'll add that as a verification step.

[brson]

I've deployed .asc files for the cargo builds and checked that the hashes match.

[rillian]

Signature files are working now.

[alexcrichton]

@brson how serious is a regression is this? Is it something we should fix ASAP? Patch rustup ASAP?

I don't currently have plans to fix this until we redo releases entirely, but we can prioritize a fix if it's causing active breakage.

[brson]

I'd like to fix before the next release. I think the fix as of now is in rust-buildbot.

[brson]

I'm still on it.

[brson]

I've deployed a fix to production. We should expect tomorrow's nightly manifests to contain the right URLs. Leaving this open until I've confirmed it works in beta as well, since the code paths are slightly different.

[rillian]

\o/

[brson]

Nightly looks fixed. Still waiting to see a beta, and actually I want to wait until we get a new stable to close this, because that's the code path that's different.