github-actions[bot] commented on code in PR #67857: URL: https://github.com/apache/doris/pull/67857#discussion_r3987841906
########## docker/compilation/Dockerfile: ########## @@ -103,9 +109,22 @@ RUN wget https://doris-community-bj-1308700295.cos.ap-beijing.myqcloud.com/tools RUN rm -f /etc/profile.d/ccache.* \ && cp /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt +# Install the Rust toolchain required by Lance-C. +ENV CARGO_HOME=/opt/cargo RUSTUP_HOME=/opt/rustup +ENV PATH="/opt/cargo/bin:${PATH}" +RUN wget -q https://sh.rustup.rs -O /tmp/rustup-init.sh \ Review Comment: [P2] Pin and verify the rustup bootstrap `--default-toolchain 1.91.0` pins Rust/Cargo, but this line still executes the current rustup bootstrap and copies its proxy into the published image. With `RUSTUP_VERSION` unset, the installer downloads from the moving `/dist` channel; archived 1.29.0 and 1.29.1 binaries already differ, so rebuilding the same Doris commit produces a different rustup binary even though the source is unchanged. The official Rust Docker images download a fixed archived `rustup-init` and verify its published SHA-256. Please pin and checksum the bootstrap here as well, while retaining the 1.91.0 toolchain selection; that also prevents a future host-requirement change from unexpectedly breaking this CentOS 7 image. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
