diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 610d9e6..bf80a0f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -330,12 +330,18 @@ jobs: node-version: 24 - name: Install just - # The same pin as scripts/setup.sh (this job skips the Rust - # toolchain, so it cannot use setup.sh's cargo-binstall path). + # The same pin as scripts/setup.sh, installed by the same + # digest-pinned cargo-binstall bootstrap (its prebuilt path needs + # no Rust toolchain; the compile fallback is disabled rather than + # assumed absent). + env: + GITHUB_TOKEN: ${{ github.token }} run: | + ./scripts/install-binstall.sh + export PATH="$HOME/.cargo/bin:$PATH" mkdir -p "$HOME/.local/bin" - curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \ - | bash -s -- --tag 1.54.0 --to "$HOME/.local/bin" + cargo-binstall --no-confirm --disable-strategies compile \ + --install-path "$HOME/.local/bin" just@1.54.0 echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Install the parity package's dependencies @@ -368,12 +374,18 @@ jobs: node-version: 24 - name: Install just - # The same pin as scripts/setup.sh (this job skips the Rust - # toolchain, so it cannot use setup.sh's cargo-binstall path). + # The same pin as scripts/setup.sh, installed by the same + # digest-pinned cargo-binstall bootstrap (its prebuilt path needs + # no Rust toolchain; the compile fallback is disabled rather than + # assumed absent). + env: + GITHUB_TOKEN: ${{ github.token }} run: | + ./scripts/install-binstall.sh + export PATH="$HOME/.cargo/bin:$PATH" mkdir -p "$HOME/.local/bin" - curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \ - | bash -s -- --tag 1.54.0 --to "$HOME/.local/bin" + cargo-binstall --no-confirm --disable-strategies compile \ + --install-path "$HOME/.local/bin" just@1.54.0 echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Download the parity page artifacts diff --git a/scripts/install-binstall.sh b/scripts/install-binstall.sh new file mode 100755 index 0000000..1e5cad2 --- /dev/null +++ b/scripts/install-binstall.sh @@ -0,0 +1,86 @@ +#!/usr/bin/env bash +# Install the pinned cargo-binstall from its GitHub release, verified +# against scripts/cargo-binstall.sha256 before it runs — never via a +# floating bootstrap script. Idempotent: an existing cargo-binstall on +# PATH is left alone. Bumping the version means re-recording those +# digests deliberately. +# +# Shared by scripts/setup.sh and the CI jobs that need one cargo tool +# without provisioning the Rust toolchain: the release asset is prebuilt, +# so nothing here needs cargo. Only the fallback for platforms without a +# pinned asset compiles from crates.io (registry checksums), and that +# path presumes a toolchain. +set -euo pipefail + +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" + +BINSTALL_VERSION="1.21.1" + +log() { printf '\n==> %s\n' "$1"; } + +have() { command -v "$1" >/dev/null 2>&1; } + +sha256_of() { + if have sha256sum; then + sha256sum "$1" | cut -d' ' -f1 + else + shasum -a 256 "$1" | cut -d' ' -f1 + fi +} + +install_binstall() { + local asset + case "$(uname -s)-$(uname -m)" in + Linux-x86_64) asset="cargo-binstall-x86_64-unknown-linux-musl.tgz" ;; + Linux-aarch64) asset="cargo-binstall-aarch64-unknown-linux-musl.tgz" ;; + Darwin-*) asset="cargo-binstall-universal-apple-darwin.zip" ;; + *) asset="" ;; + esac + if [ -z "$asset" ]; then + echo "setup: no pinned cargo-binstall asset for $(uname -s)/$(uname -m); building from crates.io (registry checksums)" >&2 + cargo install cargo-binstall --locked --version "$BINSTALL_VERSION" + return + fi + + local want + want="$(grep -v '^#' "$REPO_ROOT/scripts/cargo-binstall.sha256" | awk -v a="$asset" '$2 == a { print $1 }')" + if [ -z "$want" ]; then + echo "setup: scripts/cargo-binstall.sha256 pins no digest for ${asset}; record it deliberately" >&2 + exit 1 + fi + + local tmp + tmp="$(mktemp -d)" + curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${asset}" \ + "https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/${asset}" + + local got + got="$(sha256_of "${tmp}/${asset}")" + if [ "$got" != "$want" ]; then + rm -rf "$tmp" + cat >&2 </dev/null 2>&1; } # Bootstrap cargo-binstall (prebuilt binaries; falls back to cargo install). -# It is itself pinned: the release asset for this platform is downloaded -# directly and verified against scripts/cargo-binstall.sha256 before it -# runs — never a floating bootstrap script. Bumping the version means -# re-recording those digests deliberately. -BINSTALL_VERSION="1.21.1" - -sha256_of() { - if have sha256sum; then - sha256sum "$1" | cut -d' ' -f1 - else - shasum -a 256 "$1" | cut -d' ' -f1 - fi -} - -install_binstall() { - local asset - case "$(uname -s)-$(uname -m)" in - Linux-x86_64) asset="cargo-binstall-x86_64-unknown-linux-musl.tgz" ;; - Linux-aarch64) asset="cargo-binstall-aarch64-unknown-linux-musl.tgz" ;; - Darwin-*) asset="cargo-binstall-universal-apple-darwin.zip" ;; - *) asset="" ;; - esac - if [ -z "$asset" ]; then - echo "setup: no pinned cargo-binstall asset for $(uname -s)/$(uname -m); building from crates.io (registry checksums)" >&2 - cargo install cargo-binstall --locked --version "$BINSTALL_VERSION" - return - fi - - local want - want="$(grep -v '^#' "$REPO_ROOT/scripts/cargo-binstall.sha256" | awk -v a="$asset" '$2 == a { print $1 }')" - if [ -z "$want" ]; then - echo "setup: scripts/cargo-binstall.sha256 pins no digest for ${asset}; record it deliberately" >&2 - exit 1 - fi - - local tmp - tmp="$(mktemp -d)" - curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${asset}" \ - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/${asset}" - - local got - got="$(sha256_of "${tmp}/${asset}")" - if [ "$got" != "$want" ]; then - rm -rf "$tmp" - cat >&2 <