Switch update lock files to cargo-rbmt
What changed, and why it matters
This commit is a routine build-maintenance change. It removes an old shell script used to update dependency lock files and switches the project to using a new internal tool called cargo-rbmt for the same task. There is no change to the actual Bitcoin library code, no security fix, and no vulnerability introduced.
No security action required. Treat as normal repository maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff deletes contrib/update-lock-files.sh and updates the justfile recipe update-lock-files to invoke cargo +$NIGHTLY_VERSION rbmt lock instead of the removed shell script. It also factors out a _install-tools dependency. The change only affects CI/build tooling and lock-file generation; no Rust source code or cryptographic logic is modified.
Changed components
contrib/update-lock-files.shjustfileInspect captured patch +7 / −34
diff --git a/contrib/update-lock-files.sh b/contrib/update-lock-files.sh
deleted file mode 100755
index 6d73aae9..00000000
--- a/contrib/update-lock-files.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-#
-# Update the minimal and recent lock files.
-
-set -euo pipefail
-
-NIGHTLY=$(cat nightly-version)
-
-# The `direct-minimal-versions` and `minimal-versions` dependency
-# resolution strategy flags each have a little quirk. `direct-minimal-versions`
-# allows transitive versions to upgrade, so we are not testing against
-# the actual minimum tree. `minimal-versions` allows the direct dependency
-# versions to resolve upward due to transitive requirements, so we are
-# not testing the manifest's versions. Combo'd together though, we
-# can get the best of both worlds to ensure the actual minimum dependencies
-# listed in the crate manifests build.
-
-# Check that all explicit direct dependency versions are not lying,
-# as in, they are not being bumped up by transitive dependency constraints.
-rm -f Cargo.lock && cargo +"$NIGHTLY" check --all-features -Z direct-minimal-versions
-# Now that our own direct dependency versions can be trusted, check
-# against the lowest versions of the dependency tree which still
-# satisfy constraints. Use this as the minimal version lock file.
-rm -f Cargo.lock && cargo +"$NIGHTLY" check --all-features -Z minimal-versions
-cp -f Cargo.lock Cargo-minimal.lock
-
-# Conservatively bump of recent dependencies.
-cp -f Cargo-recent.lock Cargo.lock
-cargo check --all-features
-cp -f Cargo.lock Cargo-recent.lock
diff --git a/justfile b/justfile
index 9e2cf336..051f7abf 100644
--- a/justfile
+++ b/justfile
@@ -8,10 +8,13 @@ alias ulf := update-lock-files
_default:
@just --list
+# Install necessary dev tools on system.
+_install-tools:
+ @{{justfile_directory()}}/contrib/ensure-maintainer-tools.sh
+
# Run the given CI task using maintainer tools.
[group('ci')]
-@ci task toolchain="stable" lock="recent":
- {{justfile_directory()}}/contrib/ensure-maintainer-tools.sh
+@ci task toolchain="stable" lock="recent": _install-tools
RBMT_LOG_LEVEL=quiet cargo +{{toolchain}} rbmt {{task}} --lock-file {{lock}}
# Test workspace with stable toolchain.
@@ -63,8 +66,8 @@ check-api:
# Update the recent and minimal lock files.
[group('scripts')]
-update-lock-files:
- {{justfile_directory()}}/contrib/update-lock-files.sh
+@update-lock-files: _install-tools
+ cargo +{{NIGHTLY_VERSION}} rbmt lock
# Install githooks.
[group('scripts')]
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.