mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-19 16:40:46 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/rust: security bump version to 1.94.1

Browse Source 
Note: version 1.94.1 includes security fixes for:
https://www.cve.org/CVERecord?id=CVE-2026-33055
https://www.cve.org/CVERecord?id=CVE-2026-33056

For full change logs, see:
https://blog.rust-lang.org/2026/03/26/1.94.1-release/
https://blog.rust-lang.org/2026/03/05/Rust-1.94.0/
https://blog.rust-lang.org/2026/02/12/Rust-1.93.1/
https://blog.rust-lang.org/2026/01/22/Rust-1.93.0/
https://blog.rust-lang.org/2025/12/11/Rust-1.92.0/
https://blog.rust-lang.org/2025/11/10/Rust-1.91.1/
https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/
https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/
https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/

Since Rust 1.89.0, the bootstrap was redesigned (upstream PR #119899):
the stage 0 standard library is no longer built from source but copied
from the stage 0 compiler's sysroot. This breaks host-rust in two
ways.
https://blog.rust-lang.org/inside-rust/2025/05/29/redesigning-the-initial-bootstrap-sequence/
https://github.com/rust-lang/rust/pull/119899

First, building std from source for a cross target at stage 0 now
requires build.local-rebuild to be set in config.toml. Without it,
the bootstrap refuses to proceed. Set local-rebuild = true since the
stage 0 compiler (host-rust-bin) is the same version as the compiler
being built from source.
https://github.com/rust-lang/rust/pull/145876

Second, host-rust-bin creates relative symlinks to expose the host
std libraries under its rustc component directory. The bootstrap's
copy_link_internal() copies these symlinks verbatim into the
stage0-sysroot, where the relative paths no longer resolve. Replace
them with hardlink copies (cp -al) in HOST_RUST_BIN_LIBSTD_EXTRACT.

Also, Rust received three changes in Cargo's vendoring logic which
produces different vendor directory contents.

In Rust version 1.89:

- cargo vendor now does direct extraction from .crate tarballs
  instead of heuristic file listing, adding previously excluded
  files like .cargo_vcs_info.json and hidden directories:
  https://github.com/rust-lang/cargo/pull/15514

- Files with .rej/.orig suffixes (e.g. Cargo.toml.orig) are no
  longer excluded from vendoring:
  https://github.com/rust-lang/cargo/pull/15569

In Rust version 1.94

- Git-specific files (.gitattributes, .gitignore) are now
  recursively filtered in subdirectories, not just at the top
  level:
  https://github.com/rust-lang/cargo/pull/16439

Therefore the hashes of all Cargo-fetched packages need to be
updated. This commit changes the suffix of Cargo packages from
-cargo4 to -cargo5, and updates all hashes.

Signed-off-by: Nicolas Serafini <nicolas.serafini@flyability.com>
Tested-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien:
 - mark commit as "security" and add info in commit log
 - squash version bump, bootstrap and hash fixes in a single commit
 - fix python-cryptography hash after update in commit 632e224184
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Nicolas Serafini
2026-04-11 00:42:18 +02:00
committed by Julien Olivain
parent 632e224184
commit f1f96c1ad0
39 changed files with 106 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/dust/dust.hash
View File

@@ -1,3 +1,3 @@
# Locally computed
sha256 275c2d7bd06205588b7e20e4b478e0df7213f426a1441923e3f2dfaa80cf4828 dust-1.2.3-cargo4.tar.gz
sha256 2ce1847c74a9ee1512c8ceca68c648b8dee1f7996cd5750ffbbd79a932edd129 dust-1.2.3-cargo5.tar.gz
sha256 aee6e2d13d3a55c7881630c09b41ca7b3b44bb1437b5d36695d22decc3655160 LICENSE