Install cargo tools with locked dependencies - #161428
Merged
rust-bors[bot] merged 2 commits intoAug 22, 2026
Merged
Conversation
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples. I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/ef3412518e207bea6035a1bd01f3821b.
Collaborator
|
Some changes occurred in src/doc/rustc/src/platform-support cc @Noratrieb
cc @rust-lang/clippy
cc @rust-lang/rust-analyzer
cc @rust-lang/miri
|
Collaborator
|
Thanks for the pull request, and welcome! The Rust Project has assigned @folkertdev (or someone else) to review your changes, you should hear from them (or someone else) within the next two weeks. Please see the contribution instructions for more information. Why was this reviewer chosen?The reviewer was selected based on:
|
rustbot
added
A-CI
Contributor
Author
|
I've pulled out the changes to rustc-dev-guide, rust-clippy, rust-analyzer, miri and portable-simd (and cargo which is a submodule anyway), but I'll hold off spamming PRs until I get an approval for this PR. |
konstin
added a commit
to konstin/cargo
that referenced
this pull request
Aug 20, 2026
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the rust-lang/rust and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. These are the broken out changes for cargo. rust-lang/rust#161428
konstin
added a commit
to konstin/cargo
that referenced
this pull request
Aug 21, 2026
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the rust-lang/rust and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. These are the broken out changes for cargo. rust-lang/rust#161428
Member
|
Can we remove those labels if the PR author removes the changes to the given subtrees? |
oli-obk
removed
A-rustc-dev-guide
Contributor
|
Jup, done |
weihanglo
added a commit
to weihanglo/cargo
that referenced
this pull request
Aug 21, 2026
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the rust-lang/rust and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. These are the broken out changes for cargo. rust-lang/rust#161428
Member
|
am happy for rustc-dev-guide to get changes such as these @konstin, even here |
folkertdev
reviewed
Aug 22, 2026
Contributor
rust-bors
Bot
added
S-waiting-on-bors
Member
FWIW in Miri you only found 1/3 of those somehow, it seems. |
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 22, 2026
…uwer Rollup of 9 pull requests Successful merges: - #161475 (Fix checking of LLVM prebuilt status) - #161269 (Remove `impl DebugWithContext for BorrowckDomain`) - #161419 (Doclink to `char::REPLACEMENT_CHARACTER` instead of `std::char::REPLACEMENT_CHARACTER`.) - #161428 (Install cargo tools with locked dependencies) - #161502 (Clean up a few `_inner` functions after `ensure_sufficient_stack`) - #161507 (Remove useless `!fields.is_empty()` check) - #161512 (enable next solver in Miri) - #161516 (Revert #161236 (Download auto jobs in citool in parallel)) - #161518 (rename `T-libs-api` to `T-libs` in issue templates)
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 22, 2026
Rollup merge of #161428 - konstin:konsti/cargo-install-locked, r=folkertdev Install cargo tools with locked dependencies Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0.
flip1995
pushed a commit
to flip1995/rust
that referenced
this pull request
Aug 23, 2026
…d, r=folkertdev Install cargo tools with locked dependencies Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0.
RalfJung
pushed a commit
to RalfJung/miri
that referenced
this pull request
Aug 24, 2026
…uwer Rollup of 9 pull requests Successful merges: - rust-lang/rust#161475 (Fix checking of LLVM prebuilt status) - rust-lang/rust#161269 (Remove `impl DebugWithContext for BorrowckDomain`) - rust-lang/rust#161419 (Doclink to `char::REPLACEMENT_CHARACTER` instead of `std::char::REPLACEMENT_CHARACTER`.) - rust-lang/rust#161428 (Install cargo tools with locked dependencies) - rust-lang/rust#161502 (Clean up a few `_inner` functions after `ensure_sufficient_stack`) - rust-lang/rust#161507 (Remove useless `!fields.is_empty()` check) - rust-lang/rust#161512 (enable next solver in Miri) - rust-lang/rust#161516 (Revert rust-lang/rust#161236 (Download auto jobs in citool in parallel)) - rust-lang/rust#161518 (rename `T-libs-api` to `T-libs` in issue templates)
This was referenced Aug 28, 2026
yermakoffivan
pushed a commit
to yermakoffivan/rust-clippy
that referenced
this pull request
Aug 30, 2026
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. See rust-lang/rust#161428. changelog: none <!-- homu-ignore:start --> <!-- Please read our [LLM policy] before opening a PR, If you used an LLM to generate any part of this PR, including the PR description, please disclose that according to our [guidelines][disclosure guidelines]. LLM contributions are not banned, but are held to a higher standard of review and correctness. [LLM policy]: https://forge.rust-lang.org/policies/llm-usage.html [disclosure guidelines]: https://rustc-dev-guide.rust-lang.org/llm-guidance/writing.html#disclosure-guidelines If this PR is related to an unstable feature or an otherwise tracked effort, please link to the relevant tracking issue here. If you don't know of a related tracking issue or there are none, feel free to ignore this. This PR will get automatically assigned to a reviewer. In case you would like a specific user to review your work, you can assign it to them by using r? <reviewer name> When merged, your PR's description becomes part of the commit message of a merge commit. If you do not want certain parts of it (such as your LLM disclosure) to show up in the permanent git history, surround them with a pair of HTML comments containing `homu-ignore:start` and `homu-ignore:end`. --> <!-- homu-ignore:end -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installing cargo tools (
cargo install) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Usingcargo install --lockedreduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies.I went through all
rg "cargo install"hits in the repository and added--lockedto all but explanatory examples (such as cargo's docs oncargo installitself). I validated that those tools publish functioningCargo.locks with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0.