Jens Geyer created THRIFT-6162:
----------------------------------
Summary: Rust: documented MSRV (1.65) is neither built nor
enforced and conflicts with the pinned toolchain (1.85.1)
Key: THRIFT-6162
URL: https://issues.apache.org/jira/browse/THRIFT-6162
Project: Thrift
Issue Type: Improvement
Components: Rust - Library
Reporter: Jens Geyer
The Rust binding documents a minimum supported Rust version that nothing
builds, enforces, or verifies, and that no longer matches what the tree
actually needs.
h3. Current state
* {{lib/rs/README.md}} ("Compatibility") states: "The Rust library and
auto-generated code target Rust versions 1.65+. [...] Enabling the optional
{{rustls}} feature requires Rust 1.71+."
* {{rust-toolchain}} (repo root) pins {{1.85.1}} (raised in "Rust: re-enable
dedicated CI job with toolchain 1.85.1").
* {{.github/workflows/build.yml}}, {{lib-rust}} job: {{TOOLCHAIN_VERSION:
1.85.1}}.
* {{.github/workflows/release_rust.yml}} pins {{1.85}}, with the comment: "The
repo-pinned toolchain (rust-toolchain: 1.83) predates edition2024 support
required by transitive dependencies (getrandom >= 0.4); 1.85 is the minimum
that passes."
* {{lib/rs/Cargo.toml}} has no {{rust-version}} key.
So no build anywhere -- CI, docker, or release -- ever compiles at the
documented 1.65 floor. The number is a claim in prose only.
h3. Where the 1.85 requirement comes from
{{uuid 1.25.0}} depends on {{getrandom 0.4.3}}, which is edition 2024 and
therefore needs rustc 1.85+.
Note the nuance: {{lib/rs/Cargo.toml}} declares {{uuid = "1"}} under
{{\[dependencies\]}} with no features, and {{uuid = { version = "1", features =
\["v4"\] }}} under {{\[dev-dependencies\]}}. The {{getrandom}} edge comes from
the {{v4}} feature. That means there are two distinct numbers currently
conflated under one README sentence:
* the floor to *build and test this repository* (dev-dependencies active) --
demonstrably 1.85;
* the floor for a *downstream consumer of the published crate* with default
features -- possibly lower, and currently unmeasured.
h3. Decision needed
Two directions, and I do not have a strong preference:
* *Option A -- make 1.65 real.* Add a CI job that builds {{lib/rs}} at the
documented MSRV so the promise is actually exercised, and adjust dependency
constraints until it passes. Keeps the compatibility promise to downstream
users pinned to older toolchains.
* *Option B -- document reality.* Measure the true floor (separately for
default features and for the {{rustls}} feature, as the README already
distinguishes 1.65 vs 1.71) and update the README to that number.
h3. Do this either way
Add a {{rust-version}} key to {{lib/rs/Cargo.toml}}. Cargo then enforces the
floor: it fails with an explicit "requires rustc X" message rather than
confusing syntax errors from a too-old compiler, and it warns when a dependency
bump would raise the floor -- which is exactly the drift that produced the
current mismatch.
The *value* of that key depends on which option above is chosen, so the
Cargo.toml change cannot land before the decision is made.
h3. Not caused by any open PR
This predates and is independent of the current Rust work. It surfaced while
reviewing a dependency swap (THRIFT-6159 / PR #3739), where "CI is green"
turned out not to be evidence of MSRV compliance, precisely because no build
exercises the documented floor.
----
Reported with AI assistance (Claude Opus 5).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
