Support Rust/Cargo constraints when updating artifacts

[rarkins]

What would you like Renovate to be able to do?

Pick the best version of Rust to use when running cargo.

Describe the solution you'd like

Similar to other managers, however it seems Rust doesn't currently specify minimum versions anywhere link to RFC. So therefore we should default to picking the latest semver version on Docker Hub, but allow the user to specify a valid constraint value in config.

[rarkins]

Here's what I think for Cargo:

• We check for a rust-toolchain file
• If it contains a valid version, we use that to select the image to use
• If not, we fall back to latest

Because we install with rustup, I think our image will automatically select and download the correct version anyway, e.g. even if it's a nightly we don't support. And it doesn't seem that anybody specifies cargo versions directly.

[viceice]

No, don't use rustup. We use the binary release now

[viceice]

Also I think cargo version is bound to rust version.

[rarkins]

Hmm. Using rustup would seem like a better solution. I noticed a lot of projects using nightly versions in their tool chain (not sure why) which could also influence cargo capabilities.

Cargo seems to have independent releases but be more tightly coupled with rust upgrades than npm is with node

[viceice]

ok, i'll check readding rustup with user mode and register system installed rust version

[viceice]

do you see any errors using latest rust release on repos with nighly versions now?

[rarkins]

I'm not sure we'll see errors but we may see a Cargo.lock that's different from if we supported rustup.

[rarkins]

I think this needs a regular Cargo/Rust user to help clarify requirements.

[github-actions[bot]]

Hi there,

Help us by making a minimal reproduction repository.

Before we can start work on your issue we first need to know exactly what's causing the current behavior. A minimal reproduction helps us with this.

To get started, please read our guide on creating a minimal reproduction to understand what is needed.

We may close the issue if you (or someone else) have not provided a minimal reproduction within two weeks. If you need more time, or are stuck, please ask for help or more time in a comment.

Good luck,

The Renovate team

[mercxry]

I've created a minimal reproduction repo https://github.com/mercxry/cargo-nightly-renovate-minimal-reproduction

I'm more than happy to help with whatever can solve this issue faster 😄

[rarkins]

Thanks. I'd first ask: does Renovate need to worry about installing precise versions of both Rust and Cargo, or just Rust?

[mercxry]

Cargo comes with Rust, so just Rust, I'd say that the latest of the correct channel (stable, nightly, ...) is what's important

[rarkins]

So, channels can be stable, beta or nightly. And the only practical way to support these would be using rustup?

At runtime (e.g. in the app), could we simply do the following?

• Install rustup via curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
• Run rustup toolchain install nightly (or beta or stable)

Alternatively is there an advantage to preinstalling rustup into our container? Such as speed advantage, or because it's better to be installed as root, etc.

[rarkins]

Cargo comes with Rust, so just Rust, I'd say that the latest of the correct channel (stable, nightly, ...) is what's important

BTW the reason I ask is because although npm comes with Node.js, people can have constraints on their npm version which are independent of the Node.js they need. I wanted to check if that's the same for Cargo and Rust.

[viceice]

So, channels can be stable, beta or nightly. And the only practical way to support these would be using rustup?

At runtime (e.g. in the app), could we simply do the following?

• Install rustup via curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
• Run rustup toolchain install nightly (or beta or stable)

Alternatively is there an advantage to preinstalling rustup into our container? Such as speed advantage, or because it's better to be installed as root, etc.

I think a better way is that our rust buildpack supports dynamic install and nigthly as version to install latest

• https://github.com/containerbase/buildpack/blob/main/src/usr/local/buildpack/tools/rust.sh
• https://forge.rust-lang.org/infra/other-installation-methods.html#standalone-installers

we can also easily support beta

• https://static.rust-lang.org/dist/rust-1.61.0-x86_64-unknown-linux-gnu.tar.gz (currently we support those versioned only)
• https://static.rust-lang.org/dist/rust-beta-x86_64-unknown-linux-gnu.tar.gz
• https://static.rust-lang.org/dist/rust-nightly-x86_64-unknown-linux-gnu.tar.gz

[rarkins]

So we take stable, beta or nightly as an install argument?

[viceice]

i think we can use the normal latest release as now instead of stable.

otherwise the tool installer needs to find latest release for stable tag.

[rarkins]

How about beta or unstable?

[Oliboy50]

👋 I'm a Rust user which aims to use Renovate, I came here from the Renovate Cargo manager page

I have 2 remarks on this issue:

• the link to RFC in the description has been merged, resulting in the rust-version key in Cargo.toml... which lets Rust project specify the minimal version of Rust required for this project...
  so I'm not sure, if this link is really related to your current issue about which Rust toolchain channel should Renovate use
• I don't know how Renovate works internally, therefore I don't know if Renovate will run cargo in each user project directory or if it only checks if a newer version of a crate exists in crates.io...
  if this is the former option, cargo commands can leverage the rust-toolchain.toml file at the root of the user project, and therefore will automatically download and use the specified Rust toolchain version/channel (note: this only works if cargo has been installed through Rustup)

[viceice]

How about beta or unstable?

beta and nightly channel binaries can be directly downloaded, but there is no short link for stable channel.
So we could simply ignore stable when extract and let renovate use latest stable release and pass it to installer

[rbtcollins]

Wearing my rustup maintainer hat, I would recommend against renovate permitting rust-toolchain.toml usage: Renovate isn't building the code, just updating the metadata, and rust-toolchain.toml can specify custom toolchains that Renovate won't have available. Better (IMO) to always use stable, document that stable will be used, and then everything should be fine.

[viceice]

Wearing my rustup maintainer hat, I would recommend against renovate permitting rust-toolchain.toml usage: Renovate isn't building the code, just updating the metadata, and rust-toolchain.toml can specify custom toolchains that Renovate won't have available. Better (IMO) to always use stable, document that stable will be used, and then everything should be fine.

That sounds good 👍

[rarkins]

Reproduction forked to https://github.com/renovate-reproductions/6365

[rarkins]

Is the approach we have in containerbase today sufficient then?

See https://github.com/containerbase/base/blob/1f24131df3c0efa6ca56c0afdfab6a46e545ef9f/src/usr/local/buildpack/tools/v2/rust.sh#L26-L32

[SoonIter]

sorry for the bothering, I encountered this problem while using renovate.
web-infra-dev/rspack#6596

It doesn't seem to use the cargo nightly version declared in rust-toolchain.toml, causing my renovate to not work properly.

[SoonIter]

is there any solution? I still haven't solved it, lol
#32898

[viceice]

needs:

• rust: support nightly channel containerbase/base#3752

[viceice]

• feat(rust): support beta and nightly containerbase/base#3785
  This will allow installing beta and nightly rust.

There is one issue when using long live renovate container.
So once installed it's not updated to a newer nightly.
This probably only targets the renovate on prem with binary source install.
Workaround is to use docker binary source (which is much slower).

[rarkins]

This approach should be fine for the hosted Mend apps, where we throw away the environment after every job. If this unlocks new capabilities then we can work out a way to "cache bust" nightly rust for other environments like Renovate CE/EE which are long-lived.

[viceice]

• rust: use channel file for download infos containerbase/base#2251
  This and the conversion to new installer will automatically resolve the issue.