Merge rust-bitcoin/rust-bitcoin#6845: ci: install rbmt from crates.io in replay job
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6845: ci: install rbmt from crates.io in replay job
bfc3703872c07560c3ed442a2bedb756596a3817 ci: install rbmt from crates.io in replay job (satsfy (Renato Britto))
Pull request description:
Closes https://github.com/rust-bitcoin/rust-bitcoin/issues/6838
The newly added `replay-crash-store` job of corpus fuzzing installed `cargo-rbmt` from version of an outdated file `rbmt-version` file that doesn't exist anymore. Pull info from `Cargo.toml` `rbmt.version`. 100% my mistake here.
ACKs for top commit:
tcharding:
ACK bfc3703872c07560c3ed442a2bedb756596a3817
apoelstra:
ACK bfc3703872c07560c3ed442a2bedb756596a3817; successfully ran local tests
Tree-SHA512: 3767090700ebf85e058acdae1fb741db2a26444ff404ea3f3036dddef58fb4a84412687b56ebf3b5f0e1a58621393782e2e7d1a6af8f84bc633cc6ab29351bd9
What changed, and why it matters
This is a routine CI maintenance fix. It changes how an internal developer tool (cargo-rbmt) is installed during an automated fuzzing replay job, switching from a pinned git revision to a version number read from the project's Cargo.toml. There is no security issue here.
No security action needed. Treat as normal CI hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates .github/workflows/corpus-fuzzing.yml. The ‘replay-crash-store’ job previously installed cargo-rbmt from a git repository at a revision stored in a file named rbmt-version, which no longer exists. The patch removes that file from the cache key and installs cargo-rbmt from crates.io using the version specified under [rbmt] in Cargo.toml. This is a build/CI tooling correction with no code or cryptographic changes.
Changed components
.github/workflows/corpus-fuzzing.ymlInspect captured patch +3 / −5
### .github/workflows/corpus-fuzzing.yml
@@ -182,16 +182,14 @@ jobs:
~/.cargo/.crates2.json
rust-bitcoin/fuzz/target
rust-bitcoin/target
- key: fuzz-${{ hashFiles('rust-bitcoin/**/Cargo.toml', 'rust-bitcoin/rbmt-version') }}
+ key: fuzz-${{ hashFiles('rust-bitcoin/**/Cargo.toml') }}
restore-keys: fuzz-
- name: Install cargo-rbmt
working-directory: rust-bitcoin
run: |
cargo install \
- --git https://git.rust-bitcoin.org/rust-bitcoin/rust-bitcoin-maintainer-tools \
- --rev "$(cat rbmt-version)" \
- cargo-rbmt \
- --locked
+ --locked \
+ cargo-rbmt@$(grep "^rbmt.version" Cargo.toml | cut -d'"' -f2)
- name: Install nightly toolchain
working-directory: rust-bitcoin
run: rustup toolchain install "$(cargo rbmt toolchains --nightly)" --profile minimal --no-self-updateWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.