Skip to content

[v3-2-test] Install rustup and cargo in CI and prod build images (#64725)#64729

Draft
github-actions[bot] wants to merge 1 commit intov3-2-testfrom
backport-1b28933-v3-2-test
Draft

[v3-2-test] Install rustup and cargo in CI and prod build images (#64725)#64729
github-actions[bot] wants to merge 1 commit intov3-2-testfrom
backport-1b28933-v3-2-test

Conversation

@github-actions
Copy link
Copy Markdown

@github-actions github-actions bot commented Apr 4, 2026

Verify rustup-init binary with SHA256 checksum instead of curl-pipe-sh

Download the rustup-init binary directly and verify its SHA256 checksum
before execution, instead of piping the shell installer script through sh.

Pin rustup-init to version 1.29.0 with hardcoded SHA256 checksums for
amd64 and arm64, matching the existing cosign verification pattern.
This prevents a compromised server from serving a tampered binary with
a matching checksum.
(cherry picked from commit 1b28933)

Co-authored-by: Jarek Potiuk jarek@potiuk.com

)

Verify rustup-init binary with SHA256 checksum instead of curl-pipe-sh

Download the rustup-init binary directly and verify its SHA256 checksum
before execution, instead of piping the shell installer script through sh.

Pin rustup-init to version 1.29.0 with hardcoded SHA256 checksums for
amd64 and arm64, matching the existing cosign verification pattern.
This prevents a compromised server from serving a tampered binary with
a matching checksum.
(cherry picked from commit 1b28933)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
@boring-cyborg boring-cyborg bot added area:dev-tools area:production-image Production image improvements and fixes backport-to-v3-2-test Mark PR with this label to backport to v3-2-test branch labels Apr 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:dev-tools area:production-image Production image improvements and fixes backport-to-v3-2-test Mark PR with this label to backport to v3-2-test branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant