Skip to content

fix clippy on rust 1.97 and pin the toolchain #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
liquidsec merged 3 commits into from
Jul 27, 2026
+7 −1
Merged

fix clippy on rust 1.97 and pin the toolchain #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a80d98c
fix clippy on rust 1.97 and pin the toolchain
liquidsec Jul 27, 2026
d9f6f12
trim rust-toolchain.toml comment
liquidsec Jul 27, 2026
1bed7d8
keep the toolchain pin out of the sdist
liquidsec Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ version = "0.9.0"
edition = "2024"
description = "Offensive-first HTTP library with Python bindings"
license = "GPL-3.0"
# CI-only pin. Shipping it would override the toolchain of anyone building from the sdist.
exclude = ["rust-toolchain.toml"]

[lib]
# When building as a Python module, we need a cdylib (shared library).
Expand Down
4 changes: 4 additions & 0 deletions rust-toolchain.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# Pinned so new clippy lints don't break dependabot PRs. Bump deliberately, fixing new lints in the same commit.
[toolchain]
channel = "1.97.1"

@singlerider singlerider Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pin is correct for CI, but as written it also ships to end users, and I'd like that fixed before merge.

rust-toolchain.toml is picked up by both cargo package and maturin sdist. Built the sdist from this branch and extracted it:

1.97.1-x86_64-unknown-linux-gnu (overridden by '.../blasthttp-0.9.0/rust-toolchain.toml')

PyPI has 50 wheels for 0.9.0, all manylinux/musllinux, so every macOS and Windows user builds from the sdist. For them this pin silently overrides their toolchain: rustup downloads an entire extra 1.97.1 toolchain, and anyone already on a newer stable gets quietly downgraded inside their own build. That's our CI policy leaking onto their machine.

One line in [package] in Cargo.toml closes both packaging paths:

exclude = ["rust-toolchain.toml"]

Verified it drops the file from cargo package --list and from maturin sdist. maturin honors the Cargo.toml exclude, so no separate [tool.maturin] exclude is needed.

Worth noting the crates.io side is already harmless: rustup only reads a toolchain file from the cwd and its parents, never from a dependency's vendored source, so downstream crates are unaffected either way. It's specifically the sdist build path that bites.

components = ["clippy", "rustfmt"]
2 changes: 1 addition & 1 deletion src/mock.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -838,7 +838,7 @@ impl PyBlasthttpMock {
Some(body_obj)
};
let files_obj = bound.getattr("files").ok();
let files = files_obj.and_then(|f| if f.is_none() { None } else { Some(f) });
let files = files_obj.filter(|f| !f.is_none());
let (body_bytes, final_headers) =
crate::python::apply_body_and_files(body, files, headers)?;
mock_entries.push(MockBatchEntry {
Expand Down
Loading