From b3d460330828da48d5d3e38c07deb0444d7575b7 Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Thu, 22 Oct 2026 11:20:59 -0700 Subject: [PATCH] Update rustup in the Docker builder (#29599) Docker builds can reuse an older rustup installer layer. Pin rustup to [1.29.2](https://blog.rust-lang.org/2026/10/20/Rustup-1.29.2/) so the builder uses a release that blocks the compromised eMudhra intermediate certificates. The Rust toolchain version is unchanged. Run the Docker image build for pull requests that change the Dockerfile. --- .github/workflows/build-docker.yml | 1 + Dockerfile | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index db9f81a922..da85ef77ea 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -16,6 +16,7 @@ on: pull_request: paths: - .github/workflows/build-docker.yml + - Dockerfile env: UV_LOCKED: 1 diff --git a/Dockerfile b/Dockerfile index 85fe0605a8..0307d40f42 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,9 +16,14 @@ RUN case "$TARGETPLATFORM" in \ "linux/amd64") echo "x86_64-unknown-linux-musl" > rust_target.txt ;; \ *) exit 1 ;; \ esac -# Update rustup whenever we bump the rust version COPY rust-toolchain.toml rust-toolchain.toml -RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --target $(cat rust_target.txt) --profile minimal --default-toolchain none +ARG RUSTUP_VERSION=1.29.2 +RUN curl --proto '=https' --tlsv1.2 -sSf \ + "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/$(uname -m)-unknown-linux-gnu/rustup-init" \ + -o rustup-init \ + && chmod +x rustup-init \ + && ./rustup-init -y --target $(cat rust_target.txt) --profile minimal --default-toolchain none \ + && rm rustup-init ENV PATH="$HOME/.cargo/bin:$PATH" # Installs the correct toolchain version from rust-toolchain.toml and then the musl target RUN rustup target add $(cat rust_target.txt)