Skip to content

Support provenance #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cole-h merged 4 commits into from
Feb 17, 2026
Merged

Support provenance #175

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
58ddbf8
ci: drop x86_64-darwin
cole-h Feb 10, 2026
fbdf338
Support provenance
cole-h Feb 10, 2026
3972f88
flake.lock: Update
cole-h Feb 12, 2026
4579e8c
flake.lock: Update
cole-h Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .cargo/config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[build]
rustflags = [
"-Clink-arg=-fuse-ld=lld",
"-Crelocation-model=static",
]

[target.aarch64-unknown-linux-musl]
rustflags = [
"-Clink-arg=-fuse-ld=lld",
"-Crelocation-model=static",
"-Clink-arg=-lgcc",
]
Comment on lines +1 to +12
Copy link

@coderabbitai coderabbitai bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Explore the repository structure
find . -type f -name "*.toml" | head -20

Repository: DeterminateSystems/magic-nix-cache

Length of output: 163

🏁 Script executed:

# Check for CI configuration
find . -type f \( -name "*.yml" -o -name "*.yaml" \) | grep -E "(github|gitlab|circleci)" | head -10

Repository: DeterminateSystems/magic-nix-cache

Length of output: 339

🏁 Script executed:

# Look at the full Cargo.toml to understand what the project builds
fd "Cargo.toml" -type f | head -1 | xargs cat

Repository: DeterminateSystems/magic-nix-cache

Length of output: 248

🏁 Script executed:

# Check for any build-related documentation or scripts
find . -type f \( -name "README*" -o -name "BUILD*" -o -name "CONTRIBUTING*" \) | head -10

Repository: DeterminateSystems/magic-nix-cache

Length of output: 111

🏁 Script executed:

# Check the main Cargo.toml
cat ./Cargo.toml

Repository: DeterminateSystems/magic-nix-cache

Length of output: 265

🏁 Script executed:

# Check the build.yaml workflow to see what targets are built
cat ./.github/workflows/build.yaml

Repository: DeterminateSystems/magic-nix-cache

Length of output: 1804

🏁 Script executed:

# Check the .cargo/config.toml file itself
cat ./.cargo/config.toml

Repository: DeterminateSystems/magic-nix-cache

Length of output: 296

🏁 Script executed:

# Look for any references to Darwin or other targets in the codebase
rg "(darwin|macos|aarch64|x86_64|gnu|musl)" -i --type toml -A 2 -B 2

Repository: DeterminateSystems/magic-nix-cache

Length of output: 5714

🏁 Script executed:

# Check if there's a flake.nix that might define the actual build targets
find . -name "flake.nix" -o -name "flake.lock" | xargs ls -la 2>/dev/null

Repository: DeterminateSystems/magic-nix-cache

Length of output: 200

🏁 Script executed:

# Look at flake.nix if it exists
fd "flake.nix" -type f | xargs cat 2>/dev/null | head -100

Repository: DeterminateSystems/magic-nix-cache

Length of output: 248

🏁 Script executed:

# Check if there are any shell.nix or default.nix files
fd "(shell|default)\.nix" -type f | xargs cat 2>/dev/null

Repository: DeterminateSystems/magic-nix-cache

Length of output: 248

🏁 Script executed:

# Search for any cross-compilation or target configuration in the repo
rg "(x86_64|aarch64|musl|gnu|darwin)" --type toml --type nix -C 2 | head -80

Repository: DeterminateSystems/magic-nix-cache

Length of output: 2784

🏁 Script executed:

# Read the flake.nix to understand the build targets
cat ./flake.nix

Repository: DeterminateSystems/magic-nix-cache

Length of output: 4422

🏁 Script executed:

# Check for any other CI workflows that mention targets
cat ./.github/workflows/release-tags.yml

Repository: DeterminateSystems/magic-nix-cache

Length of output: 2196

🏁 Script executed:

# Check if the current config actually breaks anything by looking at any build issues or comments in history
git log --oneline --all -20 -- .cargo/config.toml

Repository: DeterminateSystems/magic-nix-cache

Length of output: 178

🏁 Script executed:

# Search for any issues or discussions about linker flags in commits or comments
git log --all -p -- .cargo/config.toml | head -100

Repository: DeterminateSystems/magic-nix-cache

Length of output: 2498

Scope and clarify static build rustflags to their target(s).

The global [build] rustflags apply to all targets (aarch64-darwin, x86_64-linux, aarch64-linux), while the flags are intended only for static/musl builds. Additionally, the [target.aarch64-unknown-linux-musl] section references a target not in the project's supported systems; the actual target is aarch64-unknown-linux-gnu.

Move the -fuse-ld=lld and -Crelocation-model=static flags to [target.x86_64-unknown-linux-musl] and [target.aarch64-unknown-linux-musl] instead of the global [build] section to clarify intent and avoid issues if targets expand in the future.

🔧 Suggested scoping 
-[build]
-rustflags = [
-  "-Clink-arg=-fuse-ld=lld",
-  "-Crelocation-model=static",
-]
-
+[target.x86_64-unknown-linux-musl]
+rustflags = [
+  "-Clink-arg=-fuse-ld=lld",
+  "-Crelocation-model=static",
+]
+
 [target.aarch64-unknown-linux-musl]
 rustflags = [
   "-Clink-arg=-fuse-ld=lld",
   "-Crelocation-model=static",
   "-Clink-arg=-lgcc",
 ]
🤖 Prompt for AI Agents 
In @.cargo/config.toml around lines 1 - 12, The global [build] rustflags are too
broad and currently apply to non-musl targets; remove the rustflags from [build]
and instead add those flags ("-Clink-arg=-fuse-ld=lld" and
"-Crelocation-model=static", plus "-Clink-arg=-lgcc" where needed) under
per-target sections [target.x86_64-unknown-linux-musl] and
[target.aarch64-unknown-linux-musl]; also correct the mistaken target name
(replace any reference to aarch64-unknown-linux-musl vs
aarch64-unknown-linux-gnu consistently — ensure you use
aarch64-unknown-linux-gnu where that is the actual supported target and only
place the musl flags under the musl target stanzas).

9 changes: 3 additions & 6 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,16 +18,13 @@ jobs:
systems:
- nix-system: x86_64-linux
system: X64-Linux
runner: ubuntu-22.04
runner: UbuntuLatest32Cores128G
- nix-system: aarch64-linux
system: ARM64-Linux
runner: namespace-profile-default-arm64
- nix-system: x86_64-darwin
system: X64-macOS
runner: macos-latest-xlarge
runner: UbuntuLatest32Cores128GArm
- nix-system: aarch64-darwin
system: ARM64-macOS
runner: macos-latest-xlarge
runner: namespace-profile-mac-m2-12c28g
steps:
- uses: actions/checkout@v4
- name: Install Nix on ${{ matrix.systems.system }}
Expand Down
2 changes: 0 additions & 2 deletions .github/workflows/check-and-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,6 @@ jobs:
runner: ubuntu-22.04
- system: ARM64-Linux
runner: namespace-profile-default-arm64
- system: X64-macOS
runner: macos-latest-xlarge
- system: ARM64-macOS
runner: macos-latest-xlarge
permissions:
Expand Down
7 changes: 0 additions & 7 deletions .github/workflows/release-branches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,6 @@ jobs:
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-Linux
Expand Down
7 changes: 0 additions & 7 deletions .github/workflows/release-prs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,13 +43,6 @@ jobs:
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-Linux
Expand Down
8 changes: 0 additions & 8 deletions .github/workflows/release-tags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,6 @@ jobs:
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-X64-Linux
Expand All @@ -63,7 +56,6 @@ jobs:
- name: Rename binaries for GH release
run: |
mv ./artifacts/{,magic-nix-cache-closure-}ARM64-macOS
mv ./artifacts/{,magic-nix-cache-closure-}X64-macOS
mv ./artifacts/{,magic-nix-cache-closure-}X64-Linux
mv ./artifacts/{,magic-nix-cache-closure-}ARM64-Linux

Expand Down
76 changes: 62 additions & 14 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading