mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
f1f96c1ad0
Note: version 1.94.1 includes security fixes for:
https://www.cve.org/CVERecord?id=CVE-2026-33055
https://www.cve.org/CVERecord?id=CVE-2026-33056
For full change logs, see:
https://blog.rust-lang.org/2026/03/26/1.94.1-release/
https://blog.rust-lang.org/2026/03/05/Rust-1.94.0/
https://blog.rust-lang.org/2026/02/12/Rust-1.93.1/
https://blog.rust-lang.org/2026/01/22/Rust-1.93.0/
https://blog.rust-lang.org/2025/12/11/Rust-1.92.0/
https://blog.rust-lang.org/2025/11/10/Rust-1.91.1/
https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/
https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/
https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/
Since Rust 1.89.0, the bootstrap was redesigned (upstream PR #119899):
the stage 0 standard library is no longer built from source but copied
from the stage 0 compiler's sysroot. This breaks host-rust in two
ways.
https://blog.rust-lang.org/inside-rust/2025/05/29/redesigning-the-initial-bootstrap-sequence/
https://github.com/rust-lang/rust/pull/119899
First, building std from source for a cross target at stage 0 now
requires build.local-rebuild to be set in config.toml. Without it,
the bootstrap refuses to proceed. Set local-rebuild = true since the
stage 0 compiler (host-rust-bin) is the same version as the compiler
being built from source.
https://github.com/rust-lang/rust/pull/145876
Second, host-rust-bin creates relative symlinks to expose the host
std libraries under its rustc component directory. The bootstrap's
copy_link_internal() copies these symlinks verbatim into the
stage0-sysroot, where the relative paths no longer resolve. Replace
them with hardlink copies (cp -al) in HOST_RUST_BIN_LIBSTD_EXTRACT.
Also, Rust received three changes in Cargo's vendoring logic which
produces different vendor directory contents.
In Rust version 1.89:
- cargo vendor now does direct extraction from .crate tarballs
instead of heuristic file listing, adding previously excluded
files like .cargo_vcs_info.json and hidden directories:
https://github.com/rust-lang/cargo/pull/15514
- Files with .rej/.orig suffixes (e.g. Cargo.toml.orig) are no
longer excluded from vendoring:
https://github.com/rust-lang/cargo/pull/15569
In Rust version 1.94
- Git-specific files (.gitattributes, .gitignore) are now
recursively filtered in subdirectories, not just at the top
level:
https://github.com/rust-lang/cargo/pull/16439
Therefore the hashes of all Cargo-fetched packages need to be
updated. This commit changes the suffix of Cargo packages from
-cargo4 to -cargo5, and updates all hashes.
Signed-off-by: Nicolas Serafini <nicolas.serafini@flyability.com>
Tested-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien:
- mark commit as "security" and add info in commit log
- squash version bump, bootstrap and hash fixes in a single commit
- fix python-cryptography hash after update in commit 632e224184
]
Signed-off-by: Julien Olivain <ju.o@free.fr>