From e1d5aa97e8312587d6d57a5603f5ad916edf7ab8 Mon Sep 17 00:00:00 2001 From: konstin Date: Thu, 20 Aug 2026 22:37:45 +0200 Subject: [PATCH] Install cargo tools with locked dependencies Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. --- .github/workflows/ci.yml | 6 +++--- README.md | 2 +- src/backend/debugging.md | 2 +- src/building/how-to-build-and-run.md | 2 +- src/debuginfo/intro.md | 2 +- src/profiling.md | 2 +- src/profiling/with-perf.md | 4 ++-- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4108ef8c2e..bbaa6a7004 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,9 +54,9 @@ jobs: - name: Install Dependencies if: steps.mdbook-cache.outputs.cache-hit != 'true' run: | - cargo install mdbook --version ${{ env.MDBOOK_VERSION }} - cargo install mdbook-linkcheck2 --version ${{ env.MDBOOK_LINKCHECK2_VERSION }} - cargo install mdbook-mermaid --version ${{ env.MDBOOK_MERMAID_VERSION }} + cargo install --locked mdbook --version ${{ env.MDBOOK_VERSION }} + cargo install --locked mdbook-linkcheck2 --version ${{ env.MDBOOK_LINKCHECK2_VERSION }} + cargo install --locked mdbook-mermaid --version ${{ env.MDBOOK_MERMAID_VERSION }} - name: Check build run: ENABLE_LINKCHECK=1 mdbook build diff --git a/README.md b/README.md index 155455b142..21e6832633 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ Check out the forge documentation for [our policy][forge_policy]. To build a local static HTML site, install [`mdbook`](https://github.com/rust-lang/mdBook) with: ``` -cargo install mdbook mdbook-linkcheck2 mdbook-mermaid +cargo install --locked mdbook mdbook-linkcheck2 mdbook-mermaid ``` and execute the following command in the root of the repository: diff --git a/src/backend/debugging.md b/src/backend/debugging.md index 896fa20df2..4cd664b306 100644 --- a/src/backend/debugging.md +++ b/src/backend/debugging.md @@ -71,7 +71,7 @@ use the `RUSTFLAGS` environment variable (e.g. `RUSTFLAGS='--emit=llvm-ir'`). This causes rustc to spit out LLVM IR into the target directory. `cargo llvm-ir [options] path` spits out the LLVM IR for a particular function at `path`. -(`cargo install cargo-asm` installs `cargo asm` and `cargo llvm-ir`). +(`cargo install --locked cargo-asm` installs `cargo asm` and `cargo llvm-ir`). `--build-type=debug` emits code for debug builds. There are also other useful options. Also, debug info in LLVM IR can clutter the output a lot: diff --git a/src/building/how-to-build-and-run.md b/src/building/how-to-build-and-run.md index b92af3330d..3144655f31 100644 --- a/src/building/how-to-build-and-run.md +++ b/src/building/how-to-build-and-run.md @@ -155,7 +155,7 @@ There is a binary that wraps bootstrap called `x`. It runs `./x`, and can be installed system-wide and run from any subdirectory of a checkout. It also looks up the appropriate version of Python to use and avoids depending on which shell you're currently using. -You can install it with `cargo install --path src/tools/x`. +You can install it with `cargo install --locked --path src/tools/x`. ## Create a `bootstrap.toml` diff --git a/src/debuginfo/intro.md b/src/debuginfo/intro.md index e8c4d11d12..8609d7c472 100644 --- a/src/debuginfo/intro.md +++ b/src/debuginfo/intro.md @@ -86,7 +86,7 @@ accurate, and has useful diagrams. * [pdb-rs](https://github.com/microsoft/pdb-rs/) - A Rust-based PDB reader and writer based on other publicly-available information. Does not guarantee stability or spec compliance. - Also contains `pdbtool`, which can dump PDB files (`cargo install pdbtool`) + Also contains `pdbtool`, which can dump PDB files (`cargo install --locked pdbtool`) * [Debug Interface Access SDK](https://learn.microsoft.com/en-us/visualstudio/debugger/debug-interface-access/getting-started-debug-interface-access-sdk). While it does not document the PDB format directly, details can be gleaned from the interface itself. diff --git a/src/profiling.md b/src/profiling.md index ed4e15e9c0..bc55c2298f 100644 --- a/src/profiling.md +++ b/src/profiling.md @@ -41,7 +41,7 @@ It is stored in files with `*.no-opt.bc` extension in LLVM bitcode format. Example usage: ``` -cargo install cargo-llvm-lines +cargo install --locked cargo-llvm-lines # On a normal crate you could now run `cargo llvm-lines`, but `x` isn't normal :P # Do a clean before every run, to not mix in the results from previous runs. diff --git a/src/profiling/with-perf.md b/src/profiling/with-perf.md index dd802d71c0..75194b2bdd 100644 --- a/src/profiling/with-perf.md +++ b/src/profiling/with-perf.md @@ -54,7 +54,7 @@ In case to avoid the issue of `addr2line xxx/elf: could not read first record` w collected data from `cargo`, you may need use the latest version of `addr2line`: ```bash -cargo install addr2line --features="bin" +cargo install --locked addr2line --features="bin" ``` ### Gathering a perf profile from a `perf.rust-lang.org` test @@ -161,7 +161,7 @@ It's probably easiest to explain by walking through how I would analyze NLL perf You can install perf-focus using `cargo install`: ```bash -cargo install perf-focus +cargo install --locked perf-focus ``` ### Example: How much time is spent in MIR borrowck?