From 0068abf980c7a521ae60e6d5598a20fa30c023d7 Mon Sep 17 00:00:00 2001 From: HaRoLd <303926+HarryR@users.noreply.github.com> Date: Thu, 9 Jul 2026 19:36:31 +0000 Subject: [PATCH 1/2] build: make CI and local builds byte-identical via --remap-path-prefix CI and local produced different measured binaries (stage0.efi and thus PCR4/14). Root cause: rustc embeds dependency source paths, and CI runs with CARGO_HOME=/tmp/.cargo (the Makefile's CI cache redirect) while local uses /src/.cargo, baking different absolute registry paths into the binary. Fix: --remap-path-prefix in every artifact-producing target's rustflags (musl x2, uefi x2) rewrites both /src/.cargo and /tmp/.cargo to a fixed /cargo, so the build no longer depends on where CARGO_HOME is. Verified: after the remap stage0.efi contains only /cargo/registry paths (0 /src, 0 /tmp). trim-paths would be cleaner but is still nightly-only on 1.91. Co-Authored-By: Claude Opus 4.8 --- .cargo/config.toml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 671ea88..561facf 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -6,20 +6,24 @@ # The UEFI flags reproduce the measured binaries byte-for-byte (stage0.efi, ena.efi, test-payload); # do not change them without re-pinning PCR4/PCR14 expectations. No `[build] target`: every stage0 # build passes an explicit `--target`. +# +# --remap-path-prefix rewrites the embedded dep source paths to a fixed prefix so the build does not +# depend on where CARGO_HOME is (CI uses /tmp/.cargo, local uses /src/.cargo); this is what makes CI +# and local builds byte-identical. trim-paths would be cleaner but is still nightly-only on 1.91. [target.x86_64-unknown-linux-musl] # Fully static musl for the host-side signer (stage0-sign); rust-lld, no system cc. -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] [target.aarch64-unknown-linux-musl] -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] [target.x86_64-unknown-uefi] # The measured bootloader + payloads. Static, rust-lld. -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] [target.aarch64-unknown-uefi] -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] # Host target for proc-macros and build scripts: rust-lld only (no crt-static), so they link with no # system cc. Kept out of the shared workspace config because the gnu-host repos link C and need cc. From dfae5ed70994a47ab09723309e00cdc39f9440c6 Mon Sep 17 00:00:00 2001 From: HaRoLd <303926+HarryR@users.noreply.github.com> Date: Fri, 10 Jul 2026 06:30:20 +0000 Subject: [PATCH 2/2] build: also remap the rust-src sysroot path so CI==local with rust-analyzer The CARGO_HOME remap left one divergence: when rust-src is installed (rust- analyzer does this in the local shared rustup; CI's fresh toolchain has not), rustc emits std panic-location paths from the sysroot instead of the baked /rustc/ that CI produces. Remap that sysroot path to the same /rustc/ on every artifact target so the two converge. Verified: local stage0.efi is now fully path-canonical (0 /src/.cargo, 0 /src/.rustup; only /cargo + /rustc), matching CI's build. The remap is a no-op in CI (no rust-src there). The hash is toolchain-specific; update it when bumping the toolchain (a stale value silently no-ops, which CI==local catches). Co-Authored-By: Claude Opus 4.8 --- .cargo/config.toml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 561facf..4486c9c 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -10,20 +10,24 @@ # --remap-path-prefix rewrites the embedded dep source paths to a fixed prefix so the build does not # depend on where CARGO_HOME is (CI uses /tmp/.cargo, local uses /src/.cargo); this is what makes CI # and local builds byte-identical. trim-paths would be cleaner but is still nightly-only on 1.91. +# The last remap handles rust-src: if it is installed (rust-analyzer does this locally; CI's fresh +# toolchain has not), rustc emits std panic-location paths from the sysroot instead of the baked +# /rustc/, so we remap the sysroot rust-src path to that same /rustc/. UPDATE THE HASH +# when bumping the toolchain (rustc -Vv commit-hash); a stale value silently no-ops (CI==local catches it). [target.x86_64-unknown-linux-musl] # Fully static musl for the host-side signer (stage0-sign); rust-lld, no system cc. -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"] [target.aarch64-unknown-linux-musl] -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"] [target.x86_64-unknown-uefi] # The measured bootloader + payloads. Static, rust-lld. -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"] [target.aarch64-unknown-uefi] -rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo"] +rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"] # Host target for proc-macros and build scripts: rust-lld only (no crt-static), so they link with no # system cc. Kept out of the shared workspace config because the gnu-host repos link C and need cc.