← Watch feed
Use preinstalled rustup instead of curling the installer
Public commit record
81/100 · Strong
What the developer wrote
Authored by Matt Corallo
Use preinstalled rustup instead of curling the installer
rustup is already present in the runner image, so replace every
`curl https://sh.rustup.rs | sh ...` toolchain install with a plain
`rustup default <toolchain>`, which installs the toolchain if needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
What changed, and why it matters
This commit is a routine cleanup of the project's automated build scripts. It replaces the practice of downloading and running the Rust installer from the internet with using the Rust toolchain manager (rustup) that is already installed on the build machines. There is no security vulnerability here; it is a maintenance and reliability improvement.
Recommended action
No security action required. This is a normal CI hygiene change. Reviewers may verify that the runner image indeed provides rustup and that `rustup default <toolchain>` correctly installs the required toolchain when absent.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies Forgejo workflow YAML files to change Rust toolchain installation from curl https://sh.rustup.rs | sh ... to rustup default <toolchain>. This removes a network download and shell execution step in CI, relying on the runner’s preinstalled rustup. It does not change application code, cryptographic logic, network handling, or any runtime behavior of the rust-lightning library.
Changed components
.forgejo/workflows/audit.yml.forgejo/workflows/build.yml.forgejo/workflows/check_commits.yml.forgejo/workflows/ci-build.yml.forgejo/workflows/semver.ymlInspect captured patch +14 / −14
diff --git a/.forgejo/workflows/audit.yml b/.forgejo/workflows/audit.yml
index 56516c0..45b083e 100644
--- a/.forgejo/workflows/audit.yml
+++ b/.forgejo/workflows/audit.yml
@@ -12,7 +12,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust stable toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain stable
+ rustup default stable
- name: Install cargo-audit
run: cargo install cargo-audit --locked
- name: Run cargo audit
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 0374580..d2013ea 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -20,7 +20,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust stable toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain stable
+ rustup default stable
- name: Run externalized tests
run: |
cd ext-functional-test-demo
@@ -69,7 +69,7 @@ jobs:
fetch-depth: 0
- name: Install Rust stable toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal
+ rustup default stable
- name: Run tests with coverage generation
run: |
cargo install cargo-llvm-cov
@@ -111,7 +111,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Cache routing graph snapshot
id: cache-graph
uses: actions/cache@v4
@@ -177,7 +177,7 @@ jobs:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Run cargo check for release build.
run: |
cargo check --release
@@ -208,7 +208,7 @@ jobs:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Simulate docs.rs build
run: ci/check-docsrs.sh
@@ -221,7 +221,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
run: |
cd fuzz
@@ -238,7 +238,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Clone fuzzing corpus
run: git clone --depth=1 https://github.com/lightningdevkit/ldk-fuzzing-corpus.git fuzz/ldk-fuzzing-corpus
- name: Symlink corpus into hfuzz_workspace
@@ -314,7 +314,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Install clippy
run: |
rustup component add clippy
@@ -335,7 +335,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Install rustfmt
run: |
rustup component add rustfmt
@@ -354,7 +354,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Test tor connections using lightning-net-tokio
run: |
set -eu
diff --git a/.forgejo/workflows/check_commits.yml b/.forgejo/workflows/check_commits.yml
index d7cb874..969ebaf 100644
--- a/.forgejo/workflows/check_commits.yml
+++ b/.forgejo/workflows/check_commits.yml
@@ -21,7 +21,7 @@ jobs:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ rustup default ${{ env.TOOLCHAIN }}
- name: Fetch full tree and rebase on upstream
run: |
git remote add upstream https://git.rust-bitcoin.org/lightningdevkit/rust-lightning
diff --git a/.forgejo/workflows/ci-build.yml b/.forgejo/workflows/ci-build.yml
index e691d59..ec6f281 100644
--- a/.forgejo/workflows/ci-build.yml
+++ b/.forgejo/workflows/ci-build.yml
@@ -34,7 +34,7 @@ jobs:
uses: actions/checkout@v4
- name: Install Rust ${{ matrix.toolchain }} toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ matrix.toolchain }}
+ rustup default ${{ matrix.toolchain }}
- name: Use rust-lld linker on Windows
if: matrix.platform == 'windows'
shell: bash
diff --git a/.forgejo/workflows/semver.yml b/.forgejo/workflows/semver.yml
index c200130..479517d 100644
--- a/.forgejo/workflows/semver.yml
+++ b/.forgejo/workflows/semver.yml
@@ -17,7 +17,7 @@ jobs:
fetch-depth: 0
- name: Install Rust stable toolchain
run: |
- curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain stable
+ rustup default stable
rustup override set stable
- name: Install SemVer Checker
run: cargo install cargo-semver-checks --locked
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.