From 8e45a364766fae8d72ddc940c6fbcfdc682e1abe Mon Sep 17 00:00:00 2001 From: HaRoLd <303926+HarryR@users.noreply.github.com> Date: Thu, 9 Jul 2026 12:58:29 +0000 Subject: [PATCH 1/2] cargo: drop shared musl rustflags; each repo owns its rustflags The shared config defined the musl static-link rustflags for the whole workspace. That interacts badly with two things: - Reproducibility: CI checks out each sub-repo alone, with no workspace parent and CARGO_HOME redirected, so it never sees this file. A repo relying on the shared rustflags would build differently in CI than locally. - Cargo concatenates rustflags arrays across config files (a sub-repo's does NOT override the workspace's, despite the old comment here). So a musl repo that also defines its own rustflags (stage1, os402) got them doubled once the masking global ENV RUSTFLAGS in the repo Dockerfiles is removed, which changes every compiled binary's -Cmetadata and thus its bytes. Keep only the workspace-wide [env] (SOURCE_DATE_EPOCH). Rustflags now live in each repo's own .cargo/config.toml: stage0, stage1 and os402 are self-sufficient; the gnu-host repos (vaportpm, vaportpm-zk) build gnu by default and opt into musl per build if they ever need it. Verified: with the repo Dockerfiles dropping their global RUSTFLAGS and this change in place, stage0.efi / ena.efi / payload.efi / stage1 / stage2 / linux.efi all hash identically to before. Co-Authored-By: Claude Opus 4.8 --- .cargo/config.toml | 47 +++++++++++++++------------------------------- 1 file changed, 15 insertions(+), 32 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 6688457..b5df459 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -1,39 +1,22 @@ # Shared Cargo configuration for the whole Lock.Boot workspace. # -# Because CARGO_HOME points at this directory ($WORKSPACE/.cargo), this file is -# loaded for every cargo invocation in the workspace, AND it is picked up via -# Cargo's hierarchical config discovery when running inside any sub-repo. A -# sub-repo's own .cargo/config.toml (e.g. lockboot's) takes precedence on any -# key it sets; this file provides the shared defaults. +# Because CARGO_HOME points at this directory ($WORKSPACE/.cargo), this file is loaded for every +# cargo invocation in the workspace, AND it is picked up via Cargo's hierarchical config discovery +# when running inside any sub-repo. # -# NOTE: we deliberately do NOT set `[build] target` here. The house style is -# static musl, but forcing a global default target would break the gnu-host -# repos (vaportpm, the risc0 host crate in vaportpm-zk) and the Python site -# (wavebend.org). Repos that want musl-by-default set it in their own -# .cargo/config.toml (lockboot and os402 do); everyone else opts in with -# `--target x86_64-unknown-linux-musl`. +# This file carries ONLY workspace-wide settings that every repo should share (currently just the +# reproducible-build epoch). It deliberately sets NO per-target `rustflags` and NO `[build] target`: # -# We also deliberately do NOT set a linker for the gnu host target here. The -# musl flags below only bind when a musl target is actually opted into, so they -# are safe to share; but forcing e.g. `linker=rust-lld` on the default -# x86_64-unknown-linux-gnu build would apply to vaportpm and the risc0 host -# crate (which have gcc and may link C deps) - leave gnu linking to each repo. - -[target.x86_64-unknown-linux-musl] -# Fully static linking with rustc's bundled musl and the built-in rust-lld -# linker (no system cc needed). -rustflags = [ - "-C", "linker=rust-lld", - "-C", "target-feature=+crt-static", - "-C", "link-arg=-static", -] - -[target.aarch64-unknown-linux-musl] -rustflags = [ - "-C", "linker=rust-lld", - "-C", "target-feature=+crt-static", - "-C", "link-arg=-static", -] +# - Rustflags live in each repo's own .cargo/config.toml. That is required for reproducibility: +# CI checks out each repo ALONE (no workspace parent, CARGO_HOME redirected), so a repo that +# relied on rustflags defined here would build differently in CI than locally. It is also the +# only correct behaviour given that Cargo CONCATENATES `rustflags` arrays across config files +# (a sub-repo's does NOT override the workspace's) -- defining musl flags both here and in a +# repo would double them and change every compiled binary's bytes. +# - No `[build] target`: forcing a default target would break the gnu-host repos (vaportpm, the +# risc0 host crate in vaportpm-zk) and the Python site (wavebend.org). Musl repos (stage0, +# stage1, os402) set `[build] target`/rustflags in their own config; gnu-host repos opt into +# musl per-build with `--target x86_64-unknown-linux-musl` (and their own rustflags if wanted). [env] # Reproducible builds by default across every repo. From 5597a6a08d7318f2400e8a5b14c362e92bc6fcb2 Mon Sep 17 00:00:00 2001 From: HaRoLd <303926+HarryR@users.noreply.github.com> Date: Thu, 9 Jul 2026 18:09:27 +0000 Subject: [PATCH 2/2] cargo: tighten the shared-config header comment Halve the header block, keeping the two non-obvious facts (CI checks each repo out alone, so each must be self-sufficient; cargo concatenates rustflags across config files, so do not duplicate) and the no-[build]-target reason. No config change. Co-Authored-By: Claude Opus 4.8 --- .cargo/config.toml | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index b5df459..25c33ea 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -1,22 +1,14 @@ -# Shared Cargo configuration for the whole Lock.Boot workspace. +# Shared Cargo configuration for the whole Lock.Boot workspace (loaded via CARGO_HOME, and via +# hierarchical discovery inside any sub-repo). It carries ONLY workspace-wide settings; rustflags and +# `[build] target` live in each repo's own .cargo/config.toml, for two reasons: # -# Because CARGO_HOME points at this directory ($WORKSPACE/.cargo), this file is loaded for every -# cargo invocation in the workspace, AND it is picked up via Cargo's hierarchical config discovery -# when running inside any sub-repo. +# - CI checks out each repo ALONE (no workspace parent, CARGO_HOME redirected), so anything a build +# needs must be in the repo, or CI and local diverge. +# - Cargo CONCATENATES `rustflags` across config files (a sub-repo's does NOT override this one), so +# defining flags both here and in a repo would double them and change the compiled bytes. # -# This file carries ONLY workspace-wide settings that every repo should share (currently just the -# reproducible-build epoch). It deliberately sets NO per-target `rustflags` and NO `[build] target`: -# -# - Rustflags live in each repo's own .cargo/config.toml. That is required for reproducibility: -# CI checks out each repo ALONE (no workspace parent, CARGO_HOME redirected), so a repo that -# relied on rustflags defined here would build differently in CI than locally. It is also the -# only correct behaviour given that Cargo CONCATENATES `rustflags` arrays across config files -# (a sub-repo's does NOT override the workspace's) -- defining musl flags both here and in a -# repo would double them and change every compiled binary's bytes. -# - No `[build] target`: forcing a default target would break the gnu-host repos (vaportpm, the -# risc0 host crate in vaportpm-zk) and the Python site (wavebend.org). Musl repos (stage0, -# stage1, os402) set `[build] target`/rustflags in their own config; gnu-host repos opt into -# musl per-build with `--target x86_64-unknown-linux-musl` (and their own rustflags if wanted). +# No `[build] target` here either: it would break the gnu-host repos (vaportpm, vaportpm-zk) and the +# Python site (wavebend.org). Musl repos set their own; gnu-host repos opt in with `--target musl`. [env] # Reproducible builds by default across every repo.