v0.31.2

install-debian13.sh

@@ -27,6 +27,9 @@ Environment:
   RUSTPROXY_ALLOW_REMOTE_ADMIN  Set to 1 only to permit plain-HTTP non-loopback admin on first install
   RUSTPROXY_PREFIX         Managed install prefix (default /opt/rustproxy)
   RUSTPROXY_BUILD_JOBS     Cargo jobs for low-memory builds (default 1)
+
+The bootstrap installs/updates the builder Rust toolchain only when required
+by Cargo.toml (and respects rust-toolchain.toml, if present).
 USAGE
     exit 0
     ;;
@@ -101,11 +104,94 @@ run_builder() {
   runuser -u "$builder" -- env HOME="$builder_home" PATH="$builder_home/.cargo/bin:/usr/local/bin:/usr/bin:/bin" "$@"
 }
 
-if ! run_builder bash -lc 'command -v cargo >/dev/null 2>&1'; then
-  run_builder bash -lc "wget -qO- --https-only --secure-protocol=TLSv1_2 https://sh.rustup.rs | sh -s -- -y --profile minimal"
+run_builder git clone --depth 1 "$REPO_URL" "$work/RustProxy"
+
+# The builder, not root, owns the toolchain. Never update a system-wide
+# apt-managed compiler or change the user's default rustup toolchain.
+# rustup is needed even when an older system-installed cargo exists.
+if ! run_builder bash -c 'command -v rustup >/dev/null 2>&1'; then
+  echo "Installing rustup for build user: $builder"
+  run_builder env RUSTUP_INIT_SKIP_PATH_CHECK=yes bash -c \
+    'set -o pipefail; wget -qO- --https-only --secure-protocol=TLSv1_2 https://sh.rustup.rs | sh -s -- -y --profile minimal --no-modify-path --default-toolchain none'
 fi
 
-run_builder git clone --depth 1 "$REPO_URL" "$work/RustProxy"
+# Read the actual requirements from the checked-out sources, not a hardcoded
+# Rust version. The project may inherit rust-version from [workspace.package].
+# The channel from rust-toolchain.toml (or legacy rust-toolchain) takes precedence.
+rust_settings=$(python3 - "$work/RustProxy" <<'PY_RUST'
+import pathlib
+import re
+import sys
+import tomllib
+
+repo = pathlib.Path(sys.argv[1])
+with (repo / "Cargo.toml").open("rb") as f:
+    manifest = tomllib.load(f)
+minimum = manifest.get("package", {}).get("rust-version")
+if isinstance(minimum, dict) and minimum.get("workspace"):
+    minimum = manifest.get("workspace", {}).get("package", {}).get("rust-version")
+if not isinstance(minimum, str) or not re.fullmatch(r"[0-9]+\.[0-9]+(?:\.[0-9]+)?", minimum):
+    sys.exit("Cargo.toml must declare a valid package rust-version for safe automatic toolchain updates")
+
+channel = "stable"
+toolchain_toml = repo / "rust-toolchain.toml"
+toolchain_legacy = repo / "rust-toolchain"
+if toolchain_toml.exists():
+    with toolchain_toml.open("rb") as f:
+        channel = tomllib.load(f).get("toolchain", {}).get("channel", "")
+elif toolchain_legacy.exists():
+    channel = toolchain_legacy.read_text(encoding="utf-8").strip()
+if not isinstance(channel, str) or not re.fullmatch(
+    r"(?:stable|beta|nightly|[0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[A-Za-z0-9_\-]+)?)", channel
+):
+    sys.exit(f"Unsupported rust-toolchain channel: {channel!r}")
+print(f"{minimum}|{channel}")
+PY_RUST
+)
+required_rust=${rust_settings%%|*}
+build_toolchain=${rust_settings#*|}
+
+# Compare numerically (1.100 > 1.99); do not use lexicographic ordering.
+rust_version_at_least() {
+  python3 - "$1" "$2" <<'PY_VERSION'
+import sys
+
+def version(value):
+    parts = value.split(".")
+    if len(parts) not in (2, 3) or not all(part.isdecimal() for part in parts):
+        sys.exit(2)
+    return tuple(map(int, (parts + ["0"] * (3 - len(parts)))))
+
+sys.exit(0 if version(sys.argv[1]) >= version(sys.argv[2]) else 1)
+PY_VERSION
+}
+
+# rustup run is a non-updating check: it fails when the channel is missing.
+installed_rust=$(run_builder rustup run "$build_toolchain" rustc --version 2>/dev/null | awk '$1 == "rustc" { print $2; exit }' || true)
+if [[ -z "$installed_rust" ]] || ! rust_version_at_least "$installed_rust" "$required_rust"; then
+  echo "Rust toolchain '$build_toolchain' needs installation/update (installed: ${installed_rust:-none}; required: >= $required_rust)."
+  case "$build_toolchain" in
+    stable|beta|nightly)
+      run_builder rustup update "$build_toolchain"
+      ;;
+    *)
+      # A fixed toolchain must be respected. Do not silently override a pin
+      # that is older than the manifest's minimum supported Rust version.
+      if [[ -n "$installed_rust" ]]; then
+        echo "Pinned toolchain '$build_toolchain' is older than rust-version $required_rust; fix rust-toolchain.toml in the repository." >&2
+        exit 1
+      fi
+      run_builder rustup toolchain install "$build_toolchain" --profile minimal
+      ;;
+  esac
+  installed_rust=$(run_builder rustup run "$build_toolchain" rustc --version | awk '$1 == "rustc" { print $2; exit }')
+fi
+if ! rust_version_at_least "$installed_rust" "$required_rust"; then
+  echo "Toolchain '$build_toolchain' provides Rust $installed_rust, but Cargo.toml requires $required_rust. Aborting before installation/update." >&2
+  exit 1
+fi
+run_builder rustup run "$build_toolchain" cargo --version
+echo "Building with Rust $installed_rust ($build_toolchain); required >= $required_rust."
 
 # Keep source builds reliable on small Debian VPSes. The repository release
 # profile may use LTO/codegen settings that can make rustc exceed RAM limits.
@@ -119,7 +205,11 @@ if [[ "$ALLOW_REMOTE_ADMIN" != "0" && "$ALLOW_REMOTE_ADMIN" != "1" ]]; then
   exit 1
 fi
 
-run_builder bash -lc "cd '$work/RustProxy' && CARGO_BUILD_JOBS='$BUILD_JOBS' CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 cargo build --release --locked"
+run_builder env RUSTUP_TOOLCHAIN="$build_toolchain" \
+  CARGO_BUILD_JOBS="$BUILD_JOBS" \
+  CARGO_PROFILE_RELEASE_LTO=false \
+  CARGO_PROFILE_RELEASE_CODEGEN_UNITS=8 \
+  bash -c 'cd "$1" && exec cargo build --release --locked' _ "$work/RustProxy"
 
 cd "$work/RustProxy"
 if [[ "$MODE" == install ]]; then