Opened 4 months ago

Last modified 4 months ago

#26257 needs_information defect

tor-browser-builder might want to not build rustc

Reported by: isis Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: rust, tbb-rbm
Cc: tbb-team Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

As part of #25977, teor and I were looking into how rustc is being called and built, and we noticed that the binary for 1.24.1 is downloaded and then used to compile 1.25.0. The network team's current policy is to continue using whatever rustc is the current stable until "some distro we care about" releases a new OS version which freezes the rustc they distribute. Additionally, as of eight months or so (sometime between 1.19 and 1.20) ago, the latest nightly is used to compile the next night's nightly, so it's no longer always the case that the last version will compile the current version (meaning you're probably going to end up rabbitholing each time a new stable is released to figure out which nightly you need to somehow get a copy of to build with). Additionally, on a more theoretical note, I'm not certain what we're getting in terms of Trusting Trust attacks by building the compiler only once, versus just downloading the one we need to use.

Child Tickets

Change History (2)

comment:1 Changed 4 months ago by boklm

Cc: tbb-team added
Component: Applications/rbmApplications/Tor Browser
Keywords: tbb-rbm added
Owner: changed from boklm to tbb-team

comment:2 Changed 4 months ago by boklm

Status: newneeds_information

In the list of downloads from rust-lang.org, I don't see any cross-compiler for OSX or Windows (with mingw-w64):
https://www.rust-lang.org/en-US/other-installers.html

So it seems we don't have the choice to not compile rust ourself, at least for the Windows and OSX builds.

By the way, we are planning to update to 1.26 with #26250.

Note: See TracTickets for help on using tickets.